Use a tool like `pip lock` to lock dependencies versions

We need to fix situations like the one happening here https://github.com/ClickHouse/dbt-clickhouse/issues/529. Having a locking mechanism would help us:
- Avoid unwanted dependency updates happening in clients
- Let us upgrade all dependencies easily.

The feature is still experimental and was added in 25.1 https://pip.pypa.io/en/stable/cli/pip_lock/. We may need to wait a bit until:
- The feature is not experimental anymore
- We can ensure all clients would be using it: if they are in older versions of pip, this locking mechanism would just not work for them.

Start by reviewing the linked dbt-clickhouse issue 529 and pip's pip lock documentation, then check how this repository declares and distributes dependencies. Define the supported pip versions and client behavior before deciding what locking workflow is feasible; done means dependency versions can be kept stable while still allowing an intentional full upgrade.

Written by the indexing model from the issue text.