CI: run pytype and ruff on Python code

These ensure a more consistent style and can find some errors statically
that would otherwise only be seen at run-time. Also, bump the Ubuntu
version of some other checks to get newer versions of some linters.

Closes #15067

.github/workflows/checksrc.yml

@@ -41,16 +41,22 @@ jobs:
       - name: check
         run: git ls-files -z "*.[ch]" | xargs -0 -n1 ./scripts/checksrc.pl
 
-  codespell-cmakelint:
-    runs-on: ubuntu-latest
+  codespell-cmakelint-pytype-ruff:
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4
         name: checkout
 
       - name: install
-        run: |
-          sudo apt-get install codespell python3-pip python3-pytest
-          python3 -m pip install cmakelint==1.4.3
+        env:
+          DEBIAN_FRONTEND: noninteractive
+        run: >-
+          sudo apt-get install -y --no-install-suggests --no-install-recommends
+          codespell python3-pip python3-networkx python3-pydot python3-yaml
+          python3-toml python3-markupsafe python3-jinja2 python3-tabulate
+          python3-typing-extensions python3-libcst python3-impacket
+          python3-websockets python3-pytest &&
+          python3 -m pip install --break-system-packages cmakelint==1.4.3 pytype==2024.9.13 ruff==0.6.8
 
       - name: spellcheck
         run: |
@@ -63,6 +69,12 @@ jobs:
       - name: cmakelint
         run: scripts/cmakelint.sh
 
+      - name: pytype
+        run: find . -name '*.py' -exec pytype -j auto -k {} +
+
+      - name: ruff
+        run: ruff check
+
   reuse:
     runs-on: ubuntu-latest
     steps:
@@ -73,7 +85,7 @@ jobs:
         uses: fsfe/reuse-action@3ae3c6bdf1257ab19397fab11fd3312144692083 # v4
 
   miscchecks:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4