Use a tool like `pip lock` to lock dependencies versions

[koletzilla]

We need to fix situations like the one happening here https://github.com/ClickHouse/dbt-clickhouse/issues/529. Having a locking mechanism would help us:

• Avoid unwanted dependency updates happening in clients
• Let us upgrade all dependencies easily.

The feature is still experimental and was added in 25.1 https://pip.pypa.io/en/stable/cli/pip_lock/. We may need to wait a bit until:

• The feature is not experimental anymore
• We can ensure all clients would be using it: if they are in older versions of pip, this locking mechanism would just not work for them.