Pin tox dependencies

[bytinbit]

We experienced a failing pipeline due to a mypy update and http://mypy-lang.blogspot.com/2021/05/the-upcoming-switch-to-modular-typeshed.html

Ideally the dependencies used from the tox config should be pinned, perhaps even using tox-poetry or so.

There should probably be an automated way to upgrade the lock file too,