Make the docs build resilient: drop blockdiag, pin deps, modernize CI

[lgirdwood]

What

Make the documentation build resilient and able to build on current Python
(3.11–3.14), instead of being stuck on an old, distro-provided interpreter.

Before this branch the docs would not pip install on a modern Python and the
build emitted ~59 warnings. After it, the docs build cleanly on Python 3.11–3.14
with zero version pins required, and the build is down to 2 pre-existing
warnings (a breathe limitation parsing an anonymous union bind_info in
api/component-api.rst).

Why

The fragility was structural: every painful pin (pillow<10, setuptools<81,
the pkg_resources shim) existed only to keep the orphaned
sphinxcontrib-blockdiag alive — and blockdiag was used for a single diagram.
Meanwhile CI ran on a pinned old image and installed the toolchain from distro
packages, so it never exercised a current Python and the rot went unnoticed.

Changes (one concern per commit)

1. Drop orphaned blockdiag. Convert the one diagram (mpp_layer EDF
   scheduling) to graphviz — already a dependency that renders every other
   diagram — and remove sphinxcontrib-blockdiag + pillow<10 from both
   requirements files. This removes the entire pillow<10 → setuptools<81 → pkg_resources chain.
2. Pin the supported build with a lockfile. Add scripts/constraints.txt
   (full transitive tree pinned to validated versions). Supported install is now
   pip install -r requirements.txt -c constraints.txt; requirements-lax.txt
   stays loose for drive-by contributions.
3. Modernize CI. All jobs on ubuntu-latest; supported build runs a Python
   matrix (3.11, 3.13) via setup-python + the lockfile; lax job switched off
   distro packages. Publishing is gated to one canonical Python so the matrix
   doesn't upload the html artifact twice.
4. Fix the Dockerfile. It was unbuildable (apt install python3.6 on
   ubuntu-22.04). Rebuilt on ubuntu:24.04, venv install from the lockfile,
   Doxygen built out-of-source where the Makefile expects it.
5. Catch doc/source drift. Build the Doxygen XML in an explicit CI step so
   the strict (-W) build fails the PR on drift instead of silently dropping API
   sections.
6. Exclude in-tree virtualenvs from exclude_patterns so a local .venv
   doesn't flood the build with ~50 spurious warnings.

⚠️ Depends on a companion sof change

Commit 5 surfaces drift as an error. The 4 doxygengroup: Cannot find group
warnings (alloc_api, pm_runtime, sof_dma_drivers, sof_dma_copy_func) are
caused by those groups having moved into zephyr/include/ in the sof repo,
which is missing from the Doxygen INPUT. That fix is a separate PR to
thesofproject/sof (adds zephyr/include to doc/sof.doxygen.in).

The strict CI build here will fail until that sof PR is merged, and passes
once it is. The two should land together.

Testing

• Fresh venv install from the edited requirements.txt pulls no
  pillow/blockdiag/setuptools pins; builds on Python 3.14.
• Lockfile install reproduces the pinned set exactly.
• With the companion sof change applied locally, all 4 API groups render and the
  warning count drops from 6 to 2.
• Verified the venv exclusion ignores a simulated in-tree .venv.