New dependencies in requirements.txt should include --hash

[drdavella]

Details

Using --hash when describing dependencies in requirements.txt would help to ensure that the right version is being used and validate against any potential supply chain attacks. In requirements.txt it ends up looking something like this:

SomeLibrary==1.2.3 --hash=sha256:abcdef123456...

We should make sure to add the --hash value when updating requirements.txt files. This means that it will be necessary to encode the sha256 from PyPI in the dependency object itself. We should definitely do this for our security package and we should probably do it for defusedxml as well.

As far as I can tell, using --hash is not valid with our other dependency locations such as setup.py and pyproject.toml, but it bears a bit of further investigation.

This idea was originally proposed in pixee/python-security#10