Recreate venv for each build + install from pylock.toml when available

[hugovk]

Re: python/cpython#153227 (comment)

python/cpython#153228 switched to use a dev version of pygments from GitHub, but it's not being picked up on the doc server.

This is because:

• We re-use a venv per Python version on the docs server
• pip install --upgrade -rrequirements.txt still sees pygments with the same version number in the venv, so doesn't need to upgrade it

This PR does two things:

• Clear the venv for each build. We still have a pip cache on the server, so it's not downloading everything every time. This means we'll always a fresh venv matching what we expect.
• We now have pylock.toml on newer branches (3.15+), which locks the actual required version, so this explicitly pin the dev version from GitHub. Let's use pylock.toml when when available.

[hugovk]

This ensures a fresh venv.

[hugovk]

Upgrade pip, because otherwise we use the bundled pip, and we need at least 25.1 for pylock.toml support.

Could do this just for the pylock.toml part, but might as well update for both.