pants: register requirements for contrib/examples pack

[cognifloyd]

Background

This is another part of introducing pants, as discussed in various TSC meetings.

Related PRs can be found in:

• pantsbuild milestone (which includes PRs since Initialize pantsbuild #5713)
• pantsbuild label (which also includes preparatory PRs that came before adding pantsbuild)

Overview of this PR

In #5733, I configured pants to ignore several requirements files, including contrib/examples/requirements.txt:

st2/pants.toml

Lines 28 to 29 in f25df1f

	# keep tailor from using legacy requirements files (not for pants)
	"contrib/examples/requirements.txt",

One of the reasons I excluded that file, beyond what I described in #5733, was because it includes requests which is already included in the main requirements files:

st2/contrib/examples/requirements.txt

Line 1 in f25df1f

requests

st2/requirements-pants.txt

Line 58 in f25df1f

requests[security]

If we included both of these, then pants would start complaining that import requests is ambiguous all over the place. Compare that to #5833 where I had to disambiguate some other dependencies, but those affected a more isolated set of files. We do not want to register explicit dependencies on requests all over the place as that would be quite painful. So, excluding the requirements file was the best course of action.

However, there are two more dependencies that are NOT in the main requirements file:

st2/contrib/examples/requirements.txt

Lines 2 to 3 in f25df1f

	beautifulsoup4
	flask

These deps, beautifulsoup4 and flask, are only needed for the examples pack. Including those in the main requirements file would be a signal for future contributors that they can use those in other parts of the codebase, but we don't want anything other than the examples pack to depend on them.

So, this PR:

• registers these deps locally in the contrib/examples/BUILD file, and
• regenerates lockfiles/st2.lock (introduced in pantsbuild: Generate PEX lockfile for st2 #5830).

This PR also shows an example of how github displays the lockfile diff when we add new dependencies.

Aside: Once we upgrade to pants 2.16 (which is in development), a new "dependency rules" feature will allow us to enforce that nothing else can import these deps. That will make this even safer.

Relevant Pants documentation

• How Does Pants Work? | Dependency inference
• Troubleshooting | Import errors and missing dependencies
• Dependency Inference (blog article)
• Python 3rd Party Dependencies
  • Python Lockfiles
  • Manually Generating Lockfiles

[cognifloyd]

Note: This PR needs to be merged before I can add pylint. Otherwise, pants will run into these ambiguous deps whenever it runs pylint, and pylint will subsequently fail when pants doesn't add all of the required deps to the sandbox it runs pylint in.

[amanda11]

LGTM

[rush-skills]

LGTM