ci: pin pip dependencies by hash

Add sha256 hashes for every release file to the requirements of the
astyle and natvis tools, and install Meson in the ubuntu workflow from a
new hashed requirements file with --require-hashes instead of an
unpinned "pip install meson". pip verifies all installs from these files
once they contain hashes, including the ones of the Makefile and
cmake/ci.cmake. Addresses the Scorecard Pinned-Dependencies alerts for
ubuntu.yml; the check_amalgamation.yml flags follow once develop has the
hashes.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

cmake/requirements/requirements-meson.txt

@@ -0,0 +1,3 @@
+meson==1.12.1 \
+    --hash=sha256:930bc7542cbd9f57009e182fd014eba48cf1a0180a7b9006d2d32d8f168d8b02 \
+    --hash=sha256:ab0a6ca09f8ef70c564c8241fb5a23957886a0b53fb58412b5e07eaf07dba743