Ensure any dependencies are pinned whenever tests run in CI

We already have weak pinning for pip itself in our tox config (pipsupported, piplowest), and the ability to run that against latest (pipmain). However, pip-tools' testsuite runs do not pin all of the secondary dependencies (click) and test dependencies (pytest, etc).

An unfortunate and ironic consequence is that pip-tools' own CI is somewhat unstable (see, for example: #2400), and may fail due to changes in dependencies. Typically when I see surprising CI failures, I will copy and compare the tox env output to see if packages have changed as one of my first diagnostic steps.

CI should be using fixed package versions so that it is reproducible, and we should update those pins at our discretion. Unlike docs dependency pinning (found in tox.ini under the envname pip-compile-docs), this needs to iterate over supported python versions (and platforms?) when generating pins. My best example of prior art for this is what we currently have at my work: tox envs which encapsulate per-target pinning.[^1]

[^1]: We don't handle platforms explicitly in this, but our deps are sufficiently multiplatform-friendly that it works. Possibly there are even better ways.

Dependabot may not handle the results correctly; it is already wrongly mangling our docs requirements. I consider fixing it (up to and including disabling it for these targets if appropriate) to be out of scope.

---

At PyCon, @moshez generously offered to look into this, present a plan, and execute if time allows. And if it sits for a while, the writeup above is all still a valid description of what I would like us to do.

@webknjaz , I'd like us to agree on an overall strategy before anyone implements anything. Otherwise, I think it's likely that we'll have unproductive efforts or people will spin their wheels a bit.