2.3.3
build, provenance, publish workflow
update dependencies
use pip-compile-multi for requirements
unpin sphinx and sphinx-tabs
bump werkzeug 2.3.7
drop support for python 3.7
switch docs to flit