Disable uv caching for stubsabot (#16335)

Author: AlexWaygood

.github/workflows/stubsabot.yml

@@ -28,6 +28,10 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "requirements-tests.txt"
+          # A compromised dependency in a test job on main could poison the shared
+          # uv cache. Restoring it here could execute attacker-controlled code
+          # with access to stubsabot's SSH key and GitHub token.
+          enable-cache: false
       - name: Git config
         run: |
           git config --global user.name stubsabot