add pip-compile and hash support for security/reproducibility

[mflaxman]

I'm running into a strange bug in #476, and I suspect that broken versioning is at play (though I'm not certain) so I decided to add this to specter, especially since it is very good for security. Read more about --require-hashes here.

I updated the steps for pip to first install from requirements.txt and then second install -e . as this seems to be the best practice for validating those hashes on build (kind of hackey).

[mflaxman]

Foiled by my own blackifier being down! This does indeed pass locally:

$ black . --check
All done! ✨ 🍰 ✨
64 files would be left unchanged.

[mflaxman]

Black is now fixed in #497

Once that is merged this should pass.

[mflaxman]

Black passes again, this is ready to merge! (Don't know how to get TravisCI to run)

[k9ert]

Thank you very much! This is really awesome PR. I didn't knew that this is possible and also haven't understood all implications but this is definitely very usefull. I tested the branch and the pip-installation worked. So this LGTM, i'd merge.
@ben-kaufman and @stepansnigirev please confirm, at least one of you!

[stepansnigirev]

Looks good to me!