chore: move to pipenv for package management

[jmeridth]

Part of https://github.com/github/github-ospo/issues/84

Pull Request

Proposed Changes

• [x] switch from pip to pipenv
  • seems to handle hashes better and has a lock file

Readiness Checklist

Author/Contributor

• [x] If documentation is needed for this change, has that been included in this pull request
• [x] run make lint and fix any issues that you have introduced
• [x] run make test and ensure you have test coverage for the lines you are introducing

Reviewer

• [ ] Label as either fix, documentation, enhancement, infrastructure, maintenance or breaking

[jmeridth]

whoops, need to use --platform linux_x86_64 with the pip download but this makes me think we'll either need to use all possible hashes in the requirements.txt or requirements-test.txt files or name the files according to platform.... 🤔 Gotta think on this one.

[jmeridth]

Details: https://github.com/github/github-ospo/issues/84#issuecomment-2095426271