Add CACHEDIR.TAG to uv-created virtualenvs (astral-sh#1653)

## Summary

Just as we mark virtualenvs as `gitignore`d by default, we should also
mark them as `CACHEDIR.TAG`, to ensure that they aren't included in
backups, etc.

Closes astral-sh#1648.

## Test Plan

Ran `cargo run venv` and:

```
❯ ls .venv
CACHEDIR.TAG bin          lib          pyvenv.cfg
```

crates/gourgeist/Cargo.toml

@@ -26,6 +26,7 @@ uv-cache = { path = "../uv-cache" }
 uv-interpreter = { path = "../uv-interpreter" }
 
 anstream = { workspace = true }
+cachedir = { workspace = true }
 camino = { workspace = true }
 clap = { workspace = true, features = ["derive"], optional = true }
 directories = { workspace = true }

crates/gourgeist/src/bare.rs

@@ -108,6 +108,10 @@ pub fn create_bare_venv(location: &Utf8Path, interpreter: &Interpreter) -> io::R
     };
     let bin_dir = location.join(bin_name);
 
+    // Add the CACHEDIR.TAG.
+    cachedir::ensure_tag(&location)?;
+
+    // Create a `.gitignore` file to ignore all files in the venv.
     fs::write(location.join(".gitignore"), "*")?;
 
     // Different names for the python interpreter