Require hashes and wheels for dependencies

[sethmlarson]

Including hashes means new files won't be used as candidates during the installation phase. Requiring wheels ensures that source distributions won't be used as candidates, mitigating the potential to "downgrade" to the sdist by deleting the wheel file for a release.

Both of these options together stops an intrusion in a dependency from being able to impact this GitHub Action.