Add Python 3.9 upper caps for 3.9-dropping deps and fix pip-compile hooks

[dwoz]

Summary

Two coupled fixes that stop grouped pip-updates PRs from failing on 3006.x:

1. Python 3.9 caps. Dependabot raises the shared floor of several packages to a release that no longer supports Python 3.9, leaving the py3.9 lock targets unresolvable. Each is split into a python_version < '3.10' branch capped at the last 3.9-compatible release plus an open python_version >= '3.10' branch, mirroring the existing cryptography/aiohttp/urllib3 splits. Packages capped: jaraco.functools (<4.5.0), jaraco.context (<6.1.2), msgpack (<1.2.1), more-itertools (<11.0.0), pycparser (<3.0), pythonnet (<3.1.0), virtualenv (<21.5.1), xmldiff (<3.0), zipp (<4.1.0). cryptography and pyopenssl already carry all-Python caps here, so they need no split.
2. Malformed pip-compile hooks. The Py3.13 ZeroMQ hooks (linux/freebsd/darwin/windows) and the docs hook were missing their - id: pip-compile line, so YAML folded them into the preceding Py3.14 blocks as duplicate keys and the Py3.14 CI locks never regenerated. This restores the missing ids, corrects the py3.14->py3.13 file globs, and regenerates the affected Py3.14 locks.

Test plan

• Pre-commit pip-compile hooks pass and converge.
• Full CI green (note: any pre-existing docs Inconsistent title style failure in highstate.rst is unrelated to this change).