Remove Pipfile.lock or add some CI tests

[manics]

dependabot has opened some updates against Pipfile.lock, including:

• Bump pyyaml from 5.1.1 to 5.4 #1029
• Bump pygments from 2.4.2 to 2.7.4 #1031

My understanding of Pipfile.lock is it allows you to have a fully reproducible working dev or test environment, but this implies we shouldn't merge dependency bumps to this file without testing them since semver compatible bumps may still contain bugs or unexpected interactions with other packages.

At the moment it's not tested in our GitHub workflows.

@betatim suggested removing it:

I don't know if anyone uses the Pipfile based dev setup. At least I think the Pipfile is only useful for a dev setup. In addition I think it is a feature/not a requirement that our dev setup works without a fully specified environment. We shouldn't be relying on pytest-some-plugin==1.2.3 (to pick a random sub-dependency). So overall I'd vote to remote the Pipfile stuff as a way of dealing with this.

What does everyone else think? If we want to keep it is someone willing to ensure it's tested so we can just click Merge on dependabot PRs?

[betatim]

I am not sure I know anyone who uses the lock file -> if you do actively use it please speak up :)

I am also not sure what the benefit is of having a fully pinned dev environment. Our users can't install a fully pinned environment/we don't provide the information to them, so we should be testing and developing with "loose" dependencies as well. If repo2docker breaks because of this, this is a bug that needs fixing instead of pinning a dependency precisely to some specific version.

(For deploying/running repo2docker you might want a fully pinned environment but that use case isn't covered by the lock file, I think.)