Pin pip dependencies

[jstucke]

• move all pip dependencies to requirements files so that GitHub's "dependabot" is able to track them for vulnerabilities
• pin all package versions (except for some of the packages that are directly installed from a repository)
  • this does not fix the name conflict between the python-lzo dependencies of jefferson and vmlinux-to-elf but I added a FixMe comment
• update versions in the readme.md