use hash frozen requirements.txt files (configure pip-compile with --generate-hashes)

[graingert-coef]

this project is used with highly sensitive tokens and should not run code without hash checking it first.