Pin subdependencies

[timobrembeck]

Motivation

At the moment, we only pin direct dependencies.
However, we do not enforce any constraints about their sub dependencies, so we could miss security vulnerabilities in them.

Proposed Solution

Follow the same pattern as https://github.com/digitalfabrik/integreat-cms/blob/develop/pyproject.toml to pin the entire dependency tree.

Alternatives

Install dependency manager, e.g. poetry

Depends on:

• Migrate from setup.cfg to pyproject.toml #448