Figure out a better way to update requirements via CI

[gerrymanoim]

Dependabot cannot be made to look at a single file (only a single directory). For now, I'd like to keep the older lock file around, but aggressively update the newer one.

Some options:

1. Move each individual requirement to a subfolder (does dependabot need requirements_locked and requirements.in to be in the same place?).
2. Only use a lock file for the "old" dependencies (this would cause breakage in unrelated PRs).
3. ???

Leaning to option 1.

[maread99]

Closed as superseded by #238.