Use pip-tool's pip-compile to pin all dependencies recursively

[badboy]

This ensures the builds are reproducible and don't suddenly fail from one day to another due to new releases of some dependency down the chain.

This might benefit from some documentation so everyone knows how to add/update dependencies and re-generate that file:

pip-compile --allow-unsafe --generate-hashes