Fix: Pin dependencies with cryptographic hash verification (CRITICAL supply chain security)

[aws-security-agent]

Security Fix: Unpinned Python Dependencies

This PR addresses a CRITICAL supply chain security vulnerability where dependencies were using loose version constraints (>=) without cryptographic hash verification.

Changes Made:

1. Created requirements.in - Source file with minimum version requirements
2. Converted requirements.txt - Now contains exact version pins with SHA256 hashes
3. Updated BUILD_TEST_DEPLOY.md - Added comprehensive Dependency Management section
4. Updated README.md - Added Dependency Security note with reference to detailed documentation

Security Improvements:

• ✅ All dependencies now use exact version pins (== instead of >=)
• ✅ SHA256 cryptographic hashes added for package integrity verification
• ✅ Protection against malicious package updates and compromised registries
• ✅ Reproducible builds ensured across all environments
• ✅ Clear maintenance workflow documented

Risk Mitigation:

Before: Dependencies like requests>=2.31.0 allowed ANY future version to be installed, including potentially malicious updates.

After: Dependencies like requests==2.32.3 --hash=sha256:... ensure only the exact verified package can be installed.

Maintenance:

To update dependencies in the future:

1. Edit requirements.in with desired changes
2. Run pip-compile --generate-hashes requirements.in
3. Test thoroughly
4. Commit both files

See BUILD_TEST_DEPLOY.md#dependency-management for detailed instructions.

[aws-security-agent]

AWS Security Agent is reviewing your pull request and will post feedback shortly.

[aws-security-agent]

No issues identified.