Widen oa-configurator and orm-loader pins to semver ranges

[nicoloesch]

• Closes Relax oa-configurator / orm-loader pins to semver ranges #39.

Now that both this repo and its upstream dependencies enforce semver-by-label via cava-devops CI/CD (#28), MAJOR bumps only happen on an explicit breaking-labelled PR. Replaces exact pins with >=current,<next-major ranges:

• oa-configurator==0.1.2 -> >=0.1.2,<1.0.0
• orm-loader==0.5.1 -> >=0.5.2,<1.0.0 (also picks up orm-loader's already-released 0.5.2 patch)

Also installs the cava-devops pre-commit hook, so future dependency edits keep uv.lock surgically in sync without relying on memory:

chmod +x .githooks/pre-commit
git config core.hooksPath .githooks

Notes

CI on this PR will fail until cava-devops PR AustralianCancerDataNetwork/cava-devops#2 merges to main

• ci.yml here already points at @main for the --frozen-based build-test.yml/build-test-postgres.yml, which don't exist there yet. This is expected and will resolve on its own once that PR merges; no action needed here beyond waiting.

[nicoloesch]

It was decided to absorb this change by #43 to prevent changing the semver ranges for a second time with the imminent BREAKING releases.