Hopefully I've not missed one hidden somewhere.

Also update the development status because y not.

Closes #234

It doesn't seem like you can deep link into the default? Not entirely
clear, I'll probably have to read up on rtfd redirections but that's
probably fine for now.

Turns out I did a booboo which was predictable, and if we want to
track the versioning of uap-core we can't just start diverging.

post-releases provide a path forwards, but was not initially
predicted. Special case the existing stable releases in the script,
might do something smarter eventually if necessary but...

It's not super useful, and apparently it causes issues for some tools / workflows (TBF I was surprised pip was fine with it).

Fixes #246

This helps ensure that PyPy 3.10 is actually getting tested locally.

- Can't switch release actions to trusted publishing, see #224.
- Remove git credentials persistence everywhere.
- Fix "unsafe" template expansion in release-builtins. It should not
  be accessible to any untrusted third party as it's only on
  `workflow_dispatch` and `schedule`, but it can't hurt.

Fixes #249

I assume ruff's updated a few things since last time it was run, as it
now fails.

Reported by @Rafiot: the lazy parser is not memoised, this has limited
effect on the basic / pure Python parser as its initialisation is
trivial, but it *significantly* impact the re2 and regex parsers as
they need to process regexes into a filter tree.

The memoization was mistakenly removed in #230: while refactoring
initialisation I removed the setting of the `parser` global.

- add a test to ensure the parser is correctly memoized, not
  re-instantiated every time
- reinstate setting the global
- add a mutex on `__getattr__`, it should only be used on first access
  and avoids two threads creating an expensive parser at the same
  time (which is a waste of CPU)

Fixes #253

In case where uap-core isn't a git repo (e.g. git archive), use uap-core's `package.json` as a fallback for getting a version.

Apparently the way submodules repos are configured leads to the branches not being mirrored locally (?) As such, the release job's fallback of checking out `'master'` fails whether triggered[^1] or scheduled[^2].

[^1]: https://github.com/ua-parser/uap-python/actions/runs/13090871627
[^2]: https://github.com/ua-parser/uap-python/actions/runs/13092233962

Since the environment is required via `workflow_dispatch`, the only fallback is scheduled release in which case we're publishing to pypy.

Turns out `'master'` probably worked all along as a fallback, the
problem is that I was using `'master '`, with a trailing space, which
was not a branch git managed to find for obvious reason, and since I
carried the error into the fully qualified reference... is still
didn't work.

And manual triggers didn't have the issue because the tag was
`required`, so I'd have to input the tag by hand every time, and the
fallback value would be bypassed.

- fix the fallback value
- remove the requirement on `tag`, such that it's possible to manually
  trigger the action in a default state

- add classifier for cpython 3.13
- add classifier for graal (now that it's been merged)
- add pypy 3.11 to tox
- re2 still hasn't published for CPython 3.13 so exclude from tox

Fixes #257, fixes #265