Pin dependency versions

[seifertm]

pytest-asyncio has dependencies on a bunch of other pytest plugins, in order to ensure mutual compatibility. These tests are run as part of the CI.

CI will always install the latest versions of test dependencies. When one of the dependencies releases a breaking change, the CI pipeline will fail, even if no changes in pytest-asyncio have been made. This prevents us from merging any PRs unless the breaking change is addressed. Forc merging of red PRs is still an option, but not ideal.

I propose to make use of Pip's constraints.txt to pin dependency versions. I would expect dependabot to take care of updating the pinned versions.

[seifertm]

Runtime and test dependencies are pinned to ensure reproducible builds. Build dependencies are currently not pinned. While there seem to be ways to do it, it's not supported by build at the moment (see pypa/build#292).

The current state should be good enough. Closing this for the time being.