build(deps): Keep Dependabot uv updates on internal PyPI (#8522)

Port of getsentry/sentry#126590.

Dependabot's uv PRs (e.g. #8521) rewrite every `uv.lock` source from
`pypi.devinfra.sentry.io` to `sfw.security.sentry.io`. Afterward, `uv
run --locked` fails, which is why Sphinx fails on #8521.

An org-level Dependabot private registry for Socket Firewall gets
injected into every uv job. dependabot-core passes it to `uv lock` as
`--default-index`, which overrides our `default = true` index.
`dependabot.yml` has no way to opt out of org-level registries. However,
dependabot-core skips any registry whose URL matches a *named*
`[[tool.uv.index]]`
([lock_file_updater.rb](https://github.com/dependabot/dependabot-core/blob/main/uv/lib/dependabot/uv/file_updater/lock_file_updater.rb)).
This PR names our index and declares `sfw` as `explicit = true`. uv only
uses an explicit index for packages pinned to it via
`[tool.uv.sources]`, and nothing is pinned to it.

`uv.lock` is unchanged. `uv lock --check` passes locally with uv
0.12.23.

After this merges, `@dependabot recreate` on #8521 should produce a
small lockfile diff.

<!-- junior-request-attribution:start -->
via **Elio Di Nino**.
<!-- junior-request-attribution:end -->

<!-- junior-session-footer:start -->
<!-- junior-conversation-id:slack%3AD0BU5E23PJA%3A1791310694.010509 -->

--

[View Junior
Session](https://junior-prod.sentry.dev/conversations/slack%3AD0BU5E23PJA%3A1791310694.010509)
[[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AD0BU5E23PJA%3A1791310694.010509/?project=4510944073809921)

<!-- junior-session-footer:end -->

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: Elio Di Nino <52972357+ElioDiNino@users.noreply.github.com>

Author: sentry-junior[bot]

pyproject.toml

@@ -75,9 +75,17 @@ required-environments = [
 [[tool.uv.index]]
 # We don't allow using public pypi - submit a PR to
 # https://github.com/getsentry/pypi to add a dependency.
+name = "sentry-pypi"
 url = "https://pypi.devinfra.sentry.io/simple"
 default = true
 
+[[tool.uv.index]]
+# Org-level Dependabot registry. Declaring it here stops Dependabot from
+# passing it as `--default-index`; `explicit` keeps uv from ever using it.
+name = "sfw"
+url = "https://sfw.security.sentry.io/pypi/simple"
+explicit = true
+
 [build-system]
 requires = ["uv_build"]
 build-backend = "uv_build"