Update and pin python dependencies

[Ruben-VandeVelde]

This seems to work and I think pinning everything should ensure that it keeps working, but note that pylock.toml is a very new feature, so I could also see an argument for holding out on adopting it.

[bryangingechen]

Thanks! I've been hoping to upgrade python and other dependencies in this project for a while. I'm assuming the instructions in the README are still accurate? (Maybe we want to add a .python-version and while we're at it move fully to a uv-based setup, but that might be a discussion for another time.)

[Ruben-VandeVelde]

Oh, I missed the readme. I guess the pip command there might give you different versions of the dependencies, but then I don't know if we want to recommend uv to casual users.