Update and lock dependencies

[simonwiles]

• Dependencies locked to currently used versions and compatible (bugfix) updates.
• flake8 moved to a dev. dependency.
• Fixes the security alert concerning urllib3.

All dependencies are locked to their current versions and compatible (bugfix) versions. Going forward, dependencies should be installed with pipenv sync [--dev]. Existing instances can use the same command to ensure all dependencies match.