Rethink strategy for pinning test dependencies #1899

Description of issue or feature request:

Since 5643cec we pin test dependencies in order to improve the determinism of our testing and to prevent test dependency updates from causing CI failures without the PR being tested changing.

Over approximately two weeks we have 9 open PRs from dependabot for test dependencies.

This relatively long list could potentially obfuscate dependot updates in python-tuf dependencies, which we care to address with higher priority.

Furthermore, the level of review rigour required for test dependency updates differs from the that we apply to python-tuf dependency updates.

It may be desirable to alter our approach to pinning test depependencies such that we can reduce the PR load/review implications while preserving the CI/CD determinism.

Current behavior:

Modest PR load on test dependencies which we cannot reasonably review with the same level of depth and rigour as we apply to our library dependencies.

Expected behaviour:

??

Ideas:

• @jku suggested we might only pin top-level test dependencies
• we could label test dependencies differently, so that they are easier to filter, by having a different updates entries constrained to the test dependency requirements file.