Skip uv dependencies pinned to a source that can never be updated

[Dichotomia]

What are you trying to accomplish?

Dependabot resolves every entry in [project.dependencies] against a package index. A dependency
pinned to a url source in [tool.uv.sources], or to a git source carrying no tag, is not a
registry dependency, so that lookup either:

• finds nothing — the pin is never updated, and no error says why. On a private repository, six
  upstream releases went by over seventeen days with daily runs and patterns: ["*"], and none was
  proposed;
• or finds an unrelated package that happens to share the name, and proposes a version of it.

That second outcome is the same failure #14728 described one layer down, where pin_pep508_entry was
rewriting "pkg @ git+https://…" into pkg==<version>. #14729 fixed it there, and its comment —
"already pinned to a URL" — is the same reasoning applied to the updating side.

Details and the code walk-through are in #16129.

Anything you want to highlight for special attention from reviewers?

Which source kinds, and why a tagged git source is not one of them. url always, and git only
when the entry carries no tag. A tag gives an ordering, so such a pin can be read from the remote and
written back — skipping it would forgo an update that is available. #16151 does exactly that, which
makes these two changes complementary rather than alternatives: this one covers the shapes no
ordering can be derived from, which #16151 leaves with no source and therefore still resolved against
an index.

• path entries keep their current behaviour. They are the subject of [UV] ignore sources #14644 and changing them here
  would conflate two requests.
• index entries are real registry dependencies and must keep being checked.

Consistency rather than a new policy. The Poetry path in this same parser already skips these
source kinds, through UNSUPPORTED_DEPENDENCY_TYPES. This makes the PEP 621 path behave the same way.

Why the table is read per manifest. PyprojectDocument.from_file(pyproject_file) rather than the
memoised root document, because pep621_pep735_dependencies is also called for workspace members.

Why both names are normalised. uv applies PEP 508 normalisation when matching a source to a
dependency, while the table key is written as the author typed it, so normalise is applied to both
sides.

Not covered. A PEP 508 direct reference written inline ("pkg @ git+https://…") has the same
problem, but uv/helpers/lib/parser.py emits no url for it, so surfacing one is a wider change.

How will you know you've accomplished your goal?

The spec reuses the existing uv_mixed_sources.toml fixture, extended with a git-and-tag entry so
that the boundary between what is skipped and what is kept is asserted rather than implied. It checks
the complete set of names the parser emits, so a dependency appearing or disappearing both fail it.

Removing the skip yields git-package and url-package in that set; narrowing it to git alone
drops tagged-package from it.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[sachin-sandhu]

@Dichotomia 👋🏻 , thanks for the contribution. Let me know when the PR is ready for review.

[Dichotomia]

Let me know when the PR is ready for review.

It is, and it will stop moving now: 7ccfe29, a single commit rebased on main, checks green. Apologies for the force-pushes you saw — a Sorbet fix, a title correction, and one rebase that landed just after your message. Nothing else is pending from me.