Add hashes to requirements.txt

[bact]

Use pip-compile --generate-hashes to help pin dependencies by hash.

"Human-readable" file for dependencies (using version numbers) are now in ./github/requirements/*.in.

Hashes will be generated and written to ./github/requirements/*.txt (very long files and difficult to be comprehend by human). These *.txt files will be used by pip install -r.

Hopefully will improve OpenSSF Scorecard score for Pinned-Dependencies category.

[jspeed-meyers]

Whoa! Okay, worth a try. But if this ends up creating toil for you or others, I'm fine with reverting it. But thank you for your thorough investigation and implementation.

[bact]

Looks like it does not work. The Pinned-Dependencies score stay the same at 5.
I think if this complicated thing doesn't improve anything, we better revert to the original much simpler pip.

[jspeed-meyers]

Yes, please. That sounds good to me. LMK if I need to do anything.

[bact]

Thanks for confirming, I will proceed with that.