fix(nifi-scripts): repair degraded pip dependency graph

[perezmlal]

GitHub's dependency graph reported the pip snapshot for /deployment/nifi/nifi-scripts as "Degraded" because Dependabot could not resolve the project. The consequence was not cosmetic: an unresolvable directory produces an incomplete graph, so Dependabot security alerts for this package's pip dependencies were not being generated. The exported SBOM showed asn1tools, bandit, pytest, pytest-cov, ruff and xmltodict with no version information at all, while /deployment/eventPublisher resolved normally.

Root cause: pyproject.toml declares requires-python = ">=3.9", but pytest 9.x and bandit 1.9.x both require >=3.10. Poetry must find versions installable across the entire declared range, so version solving failed. The reported error named only bandit because the solver short-circuits on the first conflict; fixing bandit alone would have moved the error to pytest.

The 3.9 floor is a real constraint, not an oversight: both runtime images build on python:3.9-slim and the CI matrix tests 3.9. This pyproject.toml is also the shared ruff configuration for all three Python packages, so raising requires-python would drag target-version with it and let the UP rules rewrite 3.9-running code to 3.10+ syntax.

Instead, declare a version per interpreter range for the two offending dev tools (pytest 8.4.x / bandit 1.8.x below 3.10, current versions above). requires-python and target-version are unchanged, so runtime support and lint semantics are untouched, and poetry install now works on both 3.9 and 3.10+ rather than failing outright.

Also:

• Commit poetry.lock so the dependency graph resolves exact versions instead of re-solving on every run. This required a negation in .gitignore, whose **/*.lock pattern was matching it.
• Add a poetry-lock CI job running "poetry check --lock", so the next occurrence of this class of failure is a red PR check rather than a degraded graph nobody notices.
• Document the per-interpreter tool versions in docs/Development.md.

Verified: poetry lock, poetry check --lock and poetry install succeed; 7 tests pass at 98.51% coverage; ruff and bandit report no findings across all three packages.

Description

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / chore

Checklist

• I have read the Contributing guidelines.
• Tests added or updated for the change (see the Testing Policy), or I have explained below why tests are not applicable.
• poetry run pytest passes locally.
• ruff check and bandit report no new issues (see the Development guide).
• Documentation updated where relevant (README, docs/, CHANGELOG.md).
• I am not including secrets, credentials, or sensitive data.
• Security-impacting changes have been considered; vulnerabilities are reported privately via SECURITY.md, not in this PR.

Notes for reviewers