Move Python deps to cmd.python

[mvgijssel]

Currently the Python deps are added directly to the Task py_binary runner target. Therefore the runner needs to be a second target generated by the task (and task_test) rule. By moving the python dependencies into the cmd.python nodes we can remove this dependency and move the runner back into the rule!

This would cleanup #325 somewhat!

While working on #451 noticed it's pretty cumbersome to get secrets into a task.