Add requirements.txt file for scanning

[desktophero]

Even if empty, declare package dependencies as needed.

This will allow scanning tools to manage upstream checks and scan for impact analysis of vulnerabilities.