Set up package pinning + dependabot

[njsmith]

Trio's requirements.in/requirements.txt + dependabot configuration has been working well. We should set it up here too. See #68 for an example of a problem that this would have caught.