Pin package and dependency versions

As #21 shows, we need to pin package and dependency versions such that we can prevent the divergence of environments.
We could use [uv](https://docs.astral.sh/uv/) for that, or use the [standards compliant `pylock.toml`](https://packaging.python.org/en/latest/specifications/pylock-toml/#pylock-toml-spec) as per [PEP 751](https://peps.python.org/pep-0751/).