Use poetry (or pipenv) to manage our dependencies

[moy]

Poetry and Pipenv both allow in particular pinning dependency versions, hence should help us to debug subtle issues related to versions like #299.

Poetry is the most recent one, uses the new standard pyproject.toml and covers stuff that pipenv doesn't like publishing to PyPI, so it's probably the best option, but I never used either of them so I may be wrong.

Step 1 is to try it and see how cool/uncool it is.