requirements and pyproject version maintenance

[kjaymiller]

I don't know if we can rely on dependabot to handle updates with Jinja involved.

My current idea is perhaps we can have the dependencies without versions.

I'd love a post_gen_hook that could look at those dependencies and pulls the latest stables and appends them or perhaps we pin versions and be okay with not updating them regularly.