Peg dependency versions

[ballenspectric]

Many of the dependencies listed in pyproject.toml give ranges or acceptable versions, or just have * for no version specifier. We should peg these so we get consistent results, and be explicit about upgrading to newer version of dependencies. We may also want to consider committing the poetry.lock file to make sure the dependencies hash to the same value.