Add requirements.txt pinning all versions of dependencies

[alyssadai]

Ensures version bumps don't affect our codebase behaviour in unexpected ways.
See also: #180 and #179

• Create pinned dependencies for Docker
• Prevent Dependabot from bumping Pydantic (to 2)
• Protect the main branch from direct commits 👀
• Update Dockerfile to use new requirements.txt

[surchs]

Until we think of a better solution, I'd say we just use https://github.com/jazzband/pip-tools/ to handle pinning of dependencies for us. requirements.txt will turn into package-lock.json and we can always run pip-compile again to update.

wdyt @Remi-Gau? It's not poetry :)

edit: oho, I don't even need requirements.in, it can run directly from setup.cfg - that's pretty nifti

[surchs]

Not sure how dependabot will deal with these changes, so I'm not making any configurations yet