build: tighten build system to only use source pkgs in more places

[SomberNight]

• the following requirements files are restricted to only include source packages:
  • requirements.txt
  • requirements-build-wine
  • requirements-build-mac
  • requirements-build-appimage
  • requirements-build-android
• note that the first four (so excluding -build-android) have already been used via pip install --no-binary :all:
  • see e.g.

    electrum/contrib/build-linux/appimage/make_appimage.sh

    Lines 113 to 114 in 4886007

    	"$python" -m pip install --no-build-isolation --no-dependencies --no-binary :all: --no-warn-script-location \
    	--cache-dir "$PIP_CACHE_DIR" -r "$CONTRIB/deterministic-build/requirements-build-appimage.txt"

    
    that is, the build scripts were already only using the source dists for these dependencies.
    So there is a larger change for -build-android here, where this was not the case before.
    • EDIT: the -build-android change was split into a separate PR due to complications...
      • android build: "req..-build-android.txt" to only use source pkgs #8000

By only including hashes for the source packages of our dependencies, (and not using prebuilt binaries,) this paves the way towards auditing our dependencies in an easier way
In the future, I would like all deps to be built from source, perhaps with a small handful of whitelisted exceptions (e.g. pyqt5 and cryptography). All the requirements-*.txt files should include hashes for only source dists.
Then, as part of running freeze_packages.sh, we could audit the diff of the sources of our deps.

[SomberNight]

Ok, so the Android build is failing...
I will split that commit out into a separate PR.

[SomberNight]

Hmm. The android build is still failing...

ok, so I believe the failure is due to rerunning freeze_packages.sh, which bumped sh==1.14.2 to sh==1.14.3.
kivy/python-for-android#2637

[SomberNight]

note: planning to have #8002 first

edit: turns out rebasing p4a atm is difficult due to NDK version incompatibility with Qt, I cherry-picked relevant p4a upstream commits onto our p4a fork instead, in e.g. 0efc881