Determine Python package dependency strategy

Our Python package dependencies are a bit of a mess, and have just caused #1525. I believe we should:

• Use setup.py for usage dependencies
• Use requirements.txt for development dependencies
• Decide on how tight/loose our version ranges should be (see https://semver.org/)
• Prioritise CI stability, but also allow automatic detection of breakages due to upversions (canary job/dependabot?)
• Research best practices in this area (RealPython, Blueprint, Hypermodern Python, poetry)

Otherwise this will bite us in future.
@timothy-nunn almost certainly has some good ideas.

• #1592