Clean up requirements.txt and README.md, pin versions, use dependabot

[justvanrossum]

• Let's get rid of all packages mentioned in requirements.txt that are not strictly needed to make DrawBot work itself.
• Let's pin all remaining requirements
• Let's use dependabot to keep the dependencies up-to-date

[typemytype]

1. They aren't needed but super helpful to be shipped with the app
2. pinning is fine
3. what action should be connected when a dependencies got an update: building an new app version is maybe over the top

[justvanrossum]

1. The package installer makes it easy enough to install additional packages. ufo2fdk??? feaPyFoFum??? The criteria for bundling are quite opaque.
3. dependabot opens PRs, so the regular PR action will run.

[typemytype]

yes the criteria are opaque but very clearly related to teaching type design students python around the world :)

It super to be able to generate font binaries and use them directly inside FormatedString

[justvanrossum]

generate font binaries

How do you do that without afdko or fontmake being bundled? fonttools.fontBuilder?

The lists in setupApp.py and requirements.txt are quite out of sync: the latter installs a bunch of things that aren't even bundled.

[justvanrossum]

Action steps:

• minor cleanups in setupApp.py
• more radical cleanup in requirements.txt
• remove test-requirements.txt