Add a CI job that is explicitly for "run with latest version of dependencies"

[exarkun]

• It should run on a schedule, not as part of normal PR workflow.
• It should be clearly marked as the "latest version" job so failures from it are more easily interpreted.
• Its results should go *somewhere* so they're not overlooked (as surely will be the default outcome if they're not part of the normal PR workflow).
• It should obey constraints in our metadata (so if we rule _out_ a new version intentionally, we don't get it).
• It should have a lot of retries so it doesn't fail because of a network error downloading new packages or a pypi API hiccup.