Better setup for managing pinned deps

[altendky]

Following up on the unresolved WIP items in #24.

Perhaps there is some tooling that can help monitor and maintain our pinned testing deps?

@crwood wrote: #24 (comment)

For what it's worth, some of these version-pins are out of date (off-hand, at least, I know Twisted 18.9.0 has been released, zope.interface 4.6.0 is out now -- there may be more..). If you're committed to pinning specific versions here, would it be worth also looking into using/enabling a service like requires.io or pyup to help update such pins moving forward? (I don't currently use these services myself, but it might ease the burden on current/future maintainers if we're going to be pinning all the things).