Use earlier macOS for earlier Python versions

[mdickinson]

This PR should get the CI back to a working baseline state. It fixes one of the various reasons that CI is currently failing on the main branch: GitHub Actions switched to ARM runners for macos-latest, and the setup-python action doesn't have Python 3.8 and 3.9 builds available for those ARM runners.

The PR also includes a version constraint on PySide6, to work around #1787, and the addition of defusedxml to the test dependencies, since it's needed by the most recent versions of Sphinx.

[mdickinson]

Marking this as ready for review. I'll fix the test-from-pypi workflow separately.

@flongford Another one for you, if you have the cycles. The branch protections will need to be updated for the new matrix combinations; I'll do that immediately prior to merge.

[mdickinson]

I'm wondering about taking a slightly different approach here: just including macos-13 in the matrix and then excluding just the two cases that we know don't work. That would mean that for more recent versions of Python, we'd be testing on both Intel and Apple Silicon-based Macs.

[flongford]

That makes sense if we're not too concerned by any additional cost that the new macos-13 runners would introduce.

[flongford]

Approving, since the changes appear to resolve the CI failures reported.

Happy to go along with any approach we take for testing different (supported) macOS os + python-runner combinations.

[mdickinson]

I'm going to leave this open for a bit; it looks as though we might have Python 3.8 and 3.9 available again on macos-latest soon, in which case this PR won't be necessary: actions/setup-python#808

[mdickinson]

Python 3.8 and Python 3.9 are now available again via setup-python on GitHub-hosted macos-latest runners, so this PR is no longer necessary.