Track transitive dependencies via pip-tools

[nchammas]

Advantages to using pip-tools:

• Approach is conservative. Just adds a relatively simple tool to the toolchain.
• Behavior is easy to understand.

Disadvantages:

• Adds a lot of new files to track.
• ~Does not handle -e . well. (See https://github.com/jazzband/pip-tools/issues/663.)~ There is a decent work-around for this.

@Perados, what do you think?

This doesn't simplify the problem of packaging. I'm also not sure if it fully addresses the issue you raised, since the compiled dependencies don't affect the package that gets published to PyPI. This may be OK, though, since you were interested in building your own packages reliably. And if the other approaches out there like Poetry and Pipenv prove to be a lot more work, then at least we have something here we can use in the interim.

Fixes #248. Prompted by the discussion here: https://github.com/nchammas/flintrock/issues/169#issuecomment-386199046

[nchammas]

Tested this end-to-end with a full run of the test suite against AWS.