lock transitive python dependencies with pip-tools

After yet another breaking package update
(docker/docker-py#3257),
its high time we permanently pin all development packages
*and their dependencies* to a known.-good version.
pip-tools lets us do that without losing the simple requirements.txt
file that allows easy installation, so lets use that.

.github/renovate.json5

@@ -1,5 +1,14 @@
 {
     "extends": [
         "github>maxhoesel-ansible/.github:renovate-config"
-    ]
+    ],
+    "pip-compile": {
+        "fileMatch": ["^requirements\\.txt$"]
+    },
+    "pip_requirements": {
+        "enabled": false
+    },
+    "pip_setup": {
+        "enabled": false
+    }
 }

CONTRIBUTING.md

@@ -170,6 +170,15 @@ The CI also builds the docs to ensure they don't break silently.
 
 ## Maintainer information
 
+### Updating Dependencies
+
+While the *Ansible* collection itself doesn't have any dependencies outside of ansible itself, the tooling used to build and test the collection does.
+We use [`pip-tools`](https://github.com/jazzband/pip-tools/) to lock these dependencies to a specific version for testing.
+This prevents random CI failures because of [`requests` updates et. al.](https://github.com/docker/docker-py/pull/3257), but still gives us a simple `requirements.txt` that anyone can install.
+
+The direct dependencies are stored in `requirements.in`, use `pip-compile requirements.in` to generate a new `requirements.txt`.
+Renovate also does this automatically in CI.
+
 ### Raising minimum supported step versions
 
 1. Change the versions in [`plugins/module_utils/constants.py`](./plugins/module_utils/constants.py)

requirements.in

@@ -0,0 +1,36 @@
+# This file is only a template!
+# Use requirements.txt generated by pip-compile to install dependencies
+
+# Requirements for developing this collection
+# Includes utilities, CLI helpers and so on
+
+# Linting & Formatting
+ansible-lint==24.5.0
+pylint==3.2.1
+autopep8==2.1.0
+pre-commit==3.7.1
+
+# Testing libraries
+pytest==8.2.0
+pytest-virtualenv==1.7.0
+docker==7.1.0
+# Dependencies for executing the role scenarios.
+molecule==6.0.2
+molecule-plugins[docker]==23.4.1
+
+# Utility packages used in scripts
+pyyaml==6.0.1
+packaging==24.0
+# Generating requirements and syncing venv
+pip-tools==7.4.1
+
+# Also include a version of ansible-core for IDE hints
+# and as the default version used in tests.
+# It is also needed for docs generation
+ansible-core==2.16.6
+
+# Docs
+antsibull-docs==2.11.0
+ansible-pygments==0.1.1
+sphinx==7.3.7
+sphinx-ansible-theme==0.10.3