Try out lockfiles for python dependency management

[davemfish]

We are interested in having tighter control over the python dependencies that are installed during our testing & building GHA workflows. Some of the problems have been discussed over here: #1306

Lockfiles provided by conda-lock seem like a plausible solution.

Some requirements:

• we still need the primary source of truth for dependencies to be in pip-compatible requirements files or pyproject.toml
  • we can generate conda-lock files from these, either from a pyproject.toml or via an intermediate conda environment.yml
• we need locked dependencies for multiple platforms (at least windows and macos). They could be contained in the same conda-lock file.
• we need locked dependencies for each Python version that we support. This may require separate lockfiles for each.
• we need a system for periodically installing & testing the latest versions of packages, beyond what might be specified in the lockfile. And then updating the lockfile accordingly.