DL3013: Pin versions in pip install

Without pinned versions, pip install pulls the latest package, which can differ between builds. An unpinned `pip install flask` today may install Flask 3.0, but tomorrow it installs Flask 3.1 with breaking changes. This breaks build reproducibility and can cause outages. Pin with == syntax and use a requirements.txt for complex dependency trees.