Add `pip-tools` to lock dependencies

[alvarobartt]

https://github.com/jazzband/pip-tools

[alvarobartt]

Didn't quite like it... so not sure if I'll add it to python-package-template...