Move deps to requirements txt

[bact]

Looks like the dependency pinning way that will satisfy security scan is to put Python dependencies in requirements.txt.
This PR creates "requirements.txt" for each workflow:

• apidoc.yml uses .github/requirements/apidoc.txt
• pylint.yml uses .github/requirements/pylint.txt
• python-publish.yml uses .github/requirements/python-publish.txt

Should addresses issues like ones in

• https://github.com/spdx/ntia-conformance-checker/security/code-scanning/47 and
• https://github.com/spdx/ntia-conformance-checker/security/code-scanning/41 , for example.

This PR also move top-level permissions to the job-level, to address Token-Permissions warning.

--

Note: This PR doesn't touch build.yml yet as I still have to figure out how to do this without failing pytest.

[bact]

@jspeed-meyers I'm not 100% sure if this will resolve the issue, I just try to follow the suggestions provided by the code scanning page. Please see if this makes sense.

[jspeed-meyers]

@bact: Looks good to me. Let's try it! TY!