Switch to pyproject.toml with pip-compile

Separate abstract requirements (what you need) from concrete dependencies (exact versions). Use `pip-compile` to generate a lock file.