Add lockfile for benchmarks

[kgryte]

We should ensure that we include a lockfile for the benchmarks in this repository in order to ensure reproducibility of results.

[asmeurer]

What's the best format to use for this? Note that scikit-learn and scipy were both tested against a specific git commit hash (scipy against an unmerged PR, scikit-learn against an unreleased commit from their main branch).

[kgryte]

A requirements.txt using specific Git hashes? See SO.