Set a minimum Python version of 3.8 [ci full]

[rvandermeulen]

The minimum Python version was recently bumped to version 3.8 in mozilla-central - see bug 1843209. I'm not sure if we have an official way of enforcing that in this repo, but we can at least bump some dependencies which have been blocked on making 3.8 the minimum.

[mhammond]

I've been seeing these fork/exec /usr/local/bin/python3: no such file or directory issues for some time now - it only seems to happen with some jobs - not the CI jobs that run for "most" PRs - and I guess I assumed some magic would happen and it would go away by itself. So I'm not sure what's going on but that specific problem doesn't seem related to these changes.

[rvandermeulen]

The main issue I'm seeing here is that the Mac TC workers likely need to be updated to run 3.8 instead of 3.7.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.81%. Comparing base (482a9fe) to head (22041a7).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5961   +/-   ##
=======================================
  Coverage   83.81%   83.81%           
=======================================
  Files         117      117           
  Lines       15666    15666           
=======================================
  Hits        13131    13131           
  Misses       2535     2535           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[bendk]

Made https://bugzilla.mozilla.org/show_bug.cgi?id=1867813 for upgrading the mac worker.

[rvandermeulen]

I feel like we should document this somewhere too? Even if to say that A-S stays in sync with m-c. Does anyone have a suggestion as to where that should go?

[tarikeshaq]

We have https://github.com/mozilla/application-services/blob/main/docs/design/rust-versions.md for our Rust versions (which ends up in https://mozilla.github.io/application-services/book/design/rust-versions.html)

We can make that document more general and include Python there or place another document next to it

[rvandermeulen]

Failing dependency check job will be handled by #6230 or something along those lines. The failing fetch-nss-artifact job will be handled by #6229 which I hope to land immediately after this one.