Introduce dependency pinning

**What's the problem you want solved?**

Dependencies are currently only specified throught `requirements.txt`, which also doesn't contain all sub-dependencies but just direct dependencies of our code. This means that our deployments are not deterministic as sub-dependency versions might change from deployment to deployment without changes to our repo.

**Is there a solution you'd like to recommend?**

Suggest and configure a tool that allows for dependency pinning.