Tooling for updating pinned dependencies

[sajith]

We've pinned most of our Python package dependencies, for example, in:

• requirements/preinstall.sh
• requirements/requirements.txt
• os_base/debian_base/Dockerfile

We will need to keep them updates (such as when there are security critical updates, or even if they are just nice-to-have updates). It would be useful to find a way to automate that step. Both pip-tools and pipenv look useful.