Replace pip with poetry, to introduce lockfiles

We are seeing a bunch of issues because we don't have lockfiles:

- With fuzzy versions, e.g. loose versioning [inside flask-base](https://github.com/canonical-web-and-design/canonicalwebteam.flask-base/blob/master/setup.py#L23), different versions of the site can be running different versions of a module
- The order in which you put dependencies in requirements.txt matters, when it shouldn't, as you'll end up with different versions of sub-dependencies depending on what was installed first

On the other hand:
- We need to check it works in dotrun and docker.