feat: support PEP 723 noxfiles

[henryiii]

I've started #848. This allows you to write a noxfile like this:

# /// script
# dependencies = ["nox>=1.2.3", "numpy"]
# ///

import nox
import numpy

@nox.session
def example(session: nox.Session) -> None:
    print(numpy.__file__)

Any dependencies, including version ranges and nox, will be checked. If not satisfied, nox will make a new .nox/_nox_script_mode environment, set it up with the above dependencies, and then pass control to the new nox environment. Requires-python is not respected yet, might need #814. That can be added later, not a target for this PR.

I've allowed this to be passed via flag and envvar, but envvar always comes first, and overrides the flag. This ensures the second run will never trigger a third run of nox. If someone has other ideas for ways to ensure this, I'm open. Also, the envvar is needed if you request an older nox, since the flag won't be valid in the "inner" run. --script-mode=fresh allows you to enforce a fresh environment.

It supports both pip and uv; since this is a new feature, defaulted to uv if available, and fallback on pip. Maybe should be configurable; currently it's locked on the "default" is uv|virtualenv.

It's a bit less clever on Windows following pipx's example; pipx doesn't use process replacement there; the original PR said it "wasn't reliable" for pipx. Looks like path quoting is not handled by this method, and it doesn't do anything special on Windows. pypa/pipx#531

Note this is available in tox as requires = ..., but before PEP 723 there wasn't a clean way to do this for nox.

Fix #414.