remove Pipenv in favor of pip-tools, security updates

[redshiftzero]

Closes #370
Closes #308
Closes #371

Testing

• Verify hashes are the same from the removed Pipfile.lock compared to requirements.txt except the two dependencies updated here
• Verify dev setup works for you following README updates
• Verify static analysis, CVE safety check, test jobs pass in CI

Required diff review

• urllib3 1.24 -> 1.24.3
• sqlalchemy 1.2.13 -> 1.3.3

Check prior to merge

• PR is made and approved over in securedrop-proxy: remove Pipenv in favor of pip-tools, security updates securedrop-proxy#33
• PR is made and approved over in securedrop-debian-packaging

[kushaldas]

This will break the package building steps. As our package index (wheel builds) + debian packaging works based on Pipfile.lock and also based on the requirements.txt with private wheel hashes.
We should discuss this more.

[redshiftzero]

Yep I know, see this message in the PR description (there's another branch in the debian packaging repo called bye-pipenv which has my wip thus far):

In draft mode because there need to be accompanying PRs over in the securedrop-debian-packaging repo and securedrop-proxy prior to us merging this here

[kushaldas]

Yep I know, see this message in the PR description (there's another branch in the debian packaging repo called bye-pipenv which has my wip thus far):

Ah, I assume it means that pipenv's new feature about updating only one package does not work as it should?

[kushaldas]

Reviewed SQLAlchemy 1.3.3 https://github.com/freedomofpress/securedrop-debian-packaging/wiki/SQLAlchemy-1.3.3

[kushaldas]

Reviewed urllib3 1.24.3 https://github.com/freedomofpress/securedrop-debian-packaging/wiki/urllib3-1.24.3

[kushaldas]

This is good. Approved 🦄 🦄 🦄 🦄 🌈

[redshiftzero]

(force pushed to resolve conflicts only)