feat: support PEP 723 noxfiles

[henryiii]

I've started #848. This allows you to write a noxfile like this:

# /// script
# dependencies = ["nox>=1.2.3", "numpy"]
# ///

import nox
import numpy

@nox.session
def example(session: nox.Session) -> None:
    print(numpy.__file__)

Any dependencies, including version ranges and nox, will be checked. If not satisfied, nox will make a new .nox/_nox_script_mode environment, set it up with the above dependencies, and then pass control to the new nox environment. Requires-python is not respected yet, might need #814.

I've allowed this to be passed via flag and envvar, but envvar always comes first, and overrides the flag. This ensures the second run will never trigger a third run of nox. If someone has other ideas for ways to ensure this, I'm open. Also, the envvar is needed if you request an older nox, since the flag won't be valid in the "inner" run. --script-mode=fresh allows you to enforce a fresh environment.

It supports both pip and uv; since this is a new feature, defaulted to uv if available, and fallback on pip. Maybe should be configurable.
I also need to check Windows, pipx doesn't use process replacement there; the original PR said it "wasn't reliable" for pipx. Not sure about us. pypa/pipx#531 The Python docs seem to indicate it's not as fancy there, but it seems like it should work. Edit: it doesn't. :)

Fix #414.