upgrade sqlalchemy >= 1.3.0

[heartsucker]

Fixes #308

Unfortunately pipenv is annoying and won't let us upgrade a single package (which really goes back to #233), so all the dependencies got updated. This brings up the question: should we aggressively upgrade to keep dependencies up to date, or should we make the smallest diff possible each time?

If we don't like the fact that all packages got updated, we should two parts to the Pipfile sections dependencies and dev-dependencies

[dependencies]
### Dependencies

foo = "==1.2.3"
# must be >= 4.5.5 b/c CVE-xxx
bar = "==4.5.6"

### Transitive Dependencies

baz = "==9.8.7"
quux = "==2.4.6"

The way we did it before with all dependencies mixed together made it unclear what was actually a first-class dependency or not.

[redshiftzero]

the especially weird part about the pipenv behavior here is that it didn't actually update sqlalchemy

[heartsucker]

Lolwut.

[redshiftzero]

closing this one in favor of #372 (returning us to pip-tools)