Refactor dependency pinning to use requirements.in and pip-compile

It makes sense to pin dependencies in requirements.txt, but the
naive method of parsing that file from setup.py meant that it was
not possible to use continuation lines (ending with backslash).
This breaks tools such as pip-compile which make it easier to deal
with pinned dependencies.

Refactor it slightly so that:

- top-level requirements, unpinned, can be listed in requirements.in
- all requirements, pinned, are listed in requirements.txt which can
  be generated/updated using pip-compile
- setup.py uses requirements.in
- CI uses requirements.txt (so tests are repeatable)

Later, container image building would also be expected to use
requirements.txt.

requirements.in

@@ -0,0 +1,3 @@
+fastapi
+pydantic
+starlette

requirements.txt

@@ -1,3 +1,33 @@
-fastapi==0.59.0 --hash=sha256:50b58aa3e7d5bcb4a4404ac7e550cc53f0cf7ca0fd13c7fd515693dc23c9caef --hash=sha256:c04dacd3deed0fd0ffdcdb116b5a04ffa257656885be7fae7234f4f62ec4a0a9
-pydantic==1.6 --hash=sha256:390844ede21e29e762c0017e46b4105edee9dcdc0119ce1aa8ab6fe58448bd2f --hash=sha256:1998e5f783c37853c6dfc1e6ba3a0cc486798b26920822b569ea883b38fd39eb
-starlette==0.13.4 --hash=sha256:0fb4b38d22945b46acb880fedee7ee143fd6c0542992501be8c45c0ed737dd1a
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    pip-compile --generate-hashes requirements.in
+#
+fastapi==0.60.0 \
+    --hash=sha256:0676191f7822da4499783c22a2355d0d25442b62a47273de518e8ea51567a12b \
+    --hash=sha256:89eb70159b211a4d3861acfb238d066f6660b6435ec99650bbea2f8ef02526fa \
+    # via -r requirements.in
+pydantic==1.6.1 \
+    --hash=sha256:1783c1d927f9e1366e0e0609ae324039b2479a1a282a98ed6a6836c9ed02002c \
+    --hash=sha256:2dc946b07cf24bee4737ced0ae77e2ea6bc97489ba5a035b603bd1b40ad81f7e \
+    --hash=sha256:2de562a456c4ecdc80cf1a8c3e70c666625f7d02d89a6174ecf63754c734592e \
+    --hash=sha256:36dbf6f1be212ab37b5fda07667461a9219c956181aa5570a00edfb0acdfe4a1 \
+    --hash=sha256:3fa799f3cfff3e5f536cbd389368fc96a44bb30308f258c94ee76b73bd60531d \
+    --hash=sha256:40d765fa2d31d5be8e29c1794657ad46f5ee583a565c83cea56630d3ae5878b9 \
+    --hash=sha256:418b84654b60e44c0cdd5384294b0e4bc1ebf42d6e873819424f3b78b8690614 \
+    --hash=sha256:4900b8820b687c9a3ed753684337979574df20e6ebe4227381d04b3c3c628f99 \
+    --hash=sha256:530d7222a2786a97bc59ee0e0ebbe23728f82974b1f1ad9a11cd966143410633 \
+    --hash=sha256:54122a8ed6b75fe1dd80797f8251ad2063ea348a03b77218d73ea9fe19bd4e73 \
+    --hash=sha256:6c3f162ba175678218629f446a947e3356415b6b09122dcb364e58c442c645a7 \
+    --hash=sha256:b49c86aecde15cde33835d5d6360e55f5e0067bb7143a8303bf03b872935c75b \
+    --hash=sha256:b5b3489cb303d0f41ad4a7390cf606a5f2c7a94dcba20c051cd1c653694cb14d \
+    --hash=sha256:cf3933c98cb5e808b62fae509f74f209730b180b1e3c3954ee3f7949e083a7df \
+    --hash=sha256:eb75dc1809875d5738df14b6566ccf9fd9c0bcde4f36b72870f318f16b9f5c20 \
+    --hash=sha256:f769141ab0abfadf3305d4fcf36660e5cf568a666dd3efab7c3d4782f70946b1 \
+    --hash=sha256:f8af9b840a9074e08c0e6dc93101de84ba95df89b267bf7151d74c553d66833b \
+    # via -r requirements.in, fastapi
+starlette==0.13.4 \
+    --hash=sha256:04fe51d86fd9a594d9b71356ed322ccde5c9b448fc716ac74155e5821a922f8d \
+    --hash=sha256:0fb4b38d22945b46acb880fedee7ee143fd6c0542992501be8c45c0ed737dd1a \
+    # via -r requirements.in, fastapi

setup.py

@@ -15,7 +15,7 @@ def get_long_description():
 
 
 def get_requirements():
-    with open("requirements.txt") as reqs:
+    with open("requirements.in") as reqs:
         return [line.split()[0] for line in reqs.read().splitlines()]