Pin versions and add a lock file to enable more repeatable builds.

[hodgestar]

Currently when the try-qutip site is built it just pulls the latest versions of most packages. It would be better if it pulled fixed versions of its dependencies (and also its transitive dependencies) because this would make the builds more reproducible.

And added complication is that some of the emscripten and juypterlite ecosystem is only packages for conda-forge, so we'll need to continue to use conda.

The first step would be to look for a suitable tool for managing and using lockfiles generated from a conda environment description.