Pin versions for all pip-installed dependencies

[englehardt]

We've had several issues randomly pop up due to changes in our underlying dependencies. These include #439 and #498. We should really pin all of the pip-installed requirements to specific versions. One approach would be to switch over to using pipenv as described in #205.

This post gives a good comparison between our options (at least as of ~1 year ago). The pip-tools suggestion at the end of the post looks reasonable. As stated there, the downside is the lack of support for conditional dependencies. This seems acceptable as we've already decided to drop support for python 2 (see #485).