Requirements.txt writer adds hashes and a way to remember to update codemodder deps

[clavedeluna]

Overview

Codemodder should include --hash.... for any new dependency it adds, but only for requirements.txt

# requirements.txt
security==1.2.1 \
    --hash=sha256:4ca5f8cfc6b836e2192a84bb5a28b72c17f3cd1abbfe3281f917394c6e6c9238 \
    --hash=sha256:0a9dc7b457330e6d0f92bdae3603fecb85394beefad0fd3b5058758a58781ded

Description

• No other dependency store (setup.py, etc) uses --hash. These are used for higher level security
• For now we decided to have these hashes hard coded into the project. However, I did add a script get-hashes to more easily get these hashes which we can then copy paste.
• Later on we can go a step further and actually use the results from the script to automatically update dependency.py or whatever other file that stores the dependencies to use.
• Separately, and not connected to this work at all, I recognized that we don't really remember when one of these dependencies gets a version update. As a temporary solution, I added a codemodder_dependencies.txt so dependabot will alert us of these changes. At that time, we would manually update. Later on we can build on this.

Closes #262

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
2.4% Duplication on New Code

See analysis details on SonarCloud