Add Python 3.14 to the CI matrix

[gagelarsen]

Third repo in the 3.14 rollout, after xmscore 7.0.13 and xmsgrid 9.1.1. No source changes.

Matrix

platform	Python
Windows	3.10, 3.13, 3.14
macOS	3.13, 3.14
Linux	3.13, 3.14
flake	3.13 (unchanged — linting is ABI-independent)

15 jobs, up from 11.

The per-platform split isn't cosmetic. [ci].python_versions fans out Windows only, where every interpreter comes from actions/setup-python and costs nothing but runner minutes. macOS and Linux need their own lists because 3.10 exists for the desktop products' Windows wheel and nothing else wants it, and because every Linux entry requires a published conan-gcc13-py<version> container — those exist for 3.13 and 3.14 only, with no image for 3.10–3.12 on any registry.

Dependency bumps

xmscore 7.0.12 → 7.0.13, xmsgrid 9.1.0 → 9.1.1 — the first releases of each carrying 3.14 binaries.

This is a hard ordering constraint, not housekeeping: the pins are exact, python_version propagates to every xms_dependencies entry in configure(), and the generated CI passes no --build-missing. A 3.14 configuration here cannot resolve until both dependencies have published 3.14 binaries. That's why the rollout walks the dependency tree one repo at a time.

No [coverage] section in this repo, so no coverage pin is needed. (Where one exists it must be pinned explicitly — coverage otherwise follows the highest Linux entry, so a matrix change would silently move the coverage gate too. xmscore needed that; this doesn't.)

Also in the regeneration (xmsconan 2.18.0 → 2.23.0)

• --wheel-dir gated on Release. 2.22.0 made the flag a request build.py must satisfy, exiting 1 when no complete set of wheels comes out, while the workflow passed it on every build type — and [matrix].pybind_build_types defaults to Release only. Without this, every Debug leg fails; xmsgrid and xmsmesher both went red on it (2.22.x breaks every Debug CI leg: --wheel-dir is now fatal, but the template still passes it where no pybind configuration exists xmsconan#110, Ask for a wheel only on the GitHub leg that publishes one xmsconan#111).
• Third-party actions pinned to commit SHAs, tag in a trailing comment. These steps run with the workflow's secrets in their environment, and a tag is a movable ref in someone else's repository.
• actions/setup-python v2 → v5 on the flake job.
• flake8-tidy-imports added. It registers banned-modules, which the generated .flake8 sets. flake8 ignores config options no installed plugin claims, so the osgeo ban was silently enforcing nothing while the job reported green.

Two follow-ups

• Branch protection needs its required checks updated to the full 15-job matrix once this PR proves the jobs exist — the current GCC-13 (Debug, Linux) / GCC-13 (Release, Linux) names no longer exist, since a fanned-out platform carries the version in its job name.
• Updated jupyter notebook in examples. #73 will need master merged in before it can go green, for the same reason.

Tag after merge: 7.0.12.