BUG: Update build dependencies to use a hash/digest

[azeemshaikh38]

Describe the bug
Makefile (and possibly other places like Dockerfiles) depend on floating dependencies, which install or pull on every build before running. This is (a) flaky since every execution is potentially different (b) inconsistent with what runs on remote (vs. local) (d) a possible security risk (e) an annoyance since the dependencies get installed on every run of make all.

Expected behavior
Maintain a dependency list (which gets checked-in), specifying the dependency and a corresponding hash/digest to be used. Update the make command to have make install which installs all of these frozen dependencies.

A nice-to-have but optional feature would be to make dependabot update these hashes/digest automatically.

[azeemshaikh38]

@dlorenc created an issue based on our discussion. Let me know if this makes sense.

[naveensrinivasan]

It was decided not to vendor dependencies #199

[inferno-chromium]

It was decided not to vendor dependencies #199

This is different, that #199 one was checking in deps as source, this one is more about supply chain security by pinning deps with sha/hash

[azeemshaikh38]

@inferno-chromium @naveensrinivasan am I right in assuming that #460 should fix this issue? Or do we need anything more here?

[naveensrinivasan]

Yes it should fix it.