Relax all pins using compatible version operator and re-freeze

[quis]

Using the compatible release operator means we can update our requirements by re-freezing, rather than manually updating quite arbitrary exact pins.

By setting the operator to only give us minor version updates we minimise the chance of introducing breaking changes when re-freezing.

---

Note that the new version of humanize now rounds to the nearest delta rather than always rounding down.

This is more accurate, but means updating a couple of our tests.

The change is the result of python-humanize/humanize#272

[CrystalPea]

It will automatically update patch versions, not minor versions, on refreeze, right?

[quis]

@CrystalPea

fido2~=1.1 means the same as fido2>=1.1,<2

So we get version 1.2.0 (minor bump) but we do not get version 2.1.1 (the latest) because that is a major version bump with breaking changes.

[CrystalPea]

@quis ohh, so we actually do do minor version bumps on re-freeze. Doesn't that make us vulnerable to supply-chain attacks, like the one in npm ecosystem recently?

[quis]

There’s nothing stopping a supply chain attack being shipped in a patch version.

At least with the re-freezing strategy we can choose to not to do a re-freeze at the time we know there is a supply chain attack in the wild.

[CrystalPea]

@quis true that!

[CrystalPea]

@quis still it's a change I wouldn't do in a hurry - maybe we could discuss it on the tech catch up before we merge it?

[risicle]

We could discuss it again, but this sort of caution is essentially how we end up very far behind on dependencies and functionally ends up being the same thing as not maintaining our dependencies.

[CrystalPea]

@risicle fair! If both you and @quis are on board, let's give it a go.

[risicle]

🤷 we've got to try it sometime.

[quis]

Add and run a refreeze-requirements command

17f326a and faec8bc

---

This automates the process of refreezing our requirements, which updates dependencies which are either tranistory or not pinned to a specific version.

Importantly it ignores versions which are less than 7 days old.

This gives us a chance to avoid newly-released dependencies which have supply chain attacks, before they’ve been identified by security scanning tools.

It would be better to go for a longer time period than 7 days. However at the moment this would mean downgrading dependencies to versions which have known vulnerabilities, which I think is the worse of two evils.

Add a dependency review PR check

655affe

---

Copies alphagov/notifications-api#4769