Relax dependency pins

I don't think there's one agreed-upon best practice, but the patch-version pins are creating API-blocking dependency conflicts. FWIW I agree with most of the answers in [this SO thread](https://stackoverflow.com/questions/28509481/should-i-pin-my-python-dependencies-versions).

If we want to ensure users can find an environment that works, why don't we specify a conda environment? IMHO, pinning to specific versions is perhaps not using setup.py in the way it seems to have been designed: with each package specifying the range of possible dependency sets, and `pip` finding an intersection. Patch-pinning all our dependencies is technically making it pretty much impossible for any other package to depend on this one right now, if they have even a slight deviation from our dependencies (even if it actually works just fine) - if every package copied our approach, the vast majority of packages would be uninstallable.