Refactor dependency pinning to use requirements.in and pip-compile

[rohanpm]

It makes sense to pin dependencies in requirements.txt, but the
naive method of parsing that file from setup.py meant that it was
not possible to use continuation lines (ending with backslash).
This breaks tools such as pip-compile which make it easier to deal
with pinned dependencies.

Refactor it slightly so that:

• top-level requirements, unpinned, can be listed in requirements.in
• all requirements, pinned, are listed in requirements.txt which can
  be generated/updated using pip-compile
• setup.py uses requirements.in
• CI uses requirements.txt (so tests are repeatable)

Later, container image building would also be expected to use
requirements.txt.

[lmilbaum]

LGTM