Installing as a module from PyPI leaves installations vulnerable to bugs in dependencies

This issue has been migrated from [#13315](https://github.com/matrix-org/synapse/issues/13315).

---

One of our [recommended](https://matrix-org.github.io/synapse/latest/setup/installation.html#installing-as-a-python-module-from-pypi) installation methods suggests installing Synapse as a module from PyPI.

This works fine, but if one of our downstream dependencies has a bug (such as a security vulnerability) then it is difficult for administrators to know they need to update their installation. This in turn leads us to have to increase our minimum dependency versions (see https://github.com/matrix-org/synapse/pull/13172 for example), which makes things difficult for downstream packagers.