fix: add hashes to requirements.txt

and update Docker images so they require hashes.

Author: SurferJeffAtGoogle

docker/owlbot/java/Dockerfile

@@ -28,7 +28,7 @@ COPY docker/owlbot/java/src /owlbot/src
 COPY docker/owlbot/java/templates /owlbot/templates
 COPY post-processor-changes.txt /post-processor-changes.txt
 RUN cd /owlbot/src && \
-    python3 -m pip install -r requirements.txt
+    python3 -m pip install --require-hashes -r requirements.txt
 
 ADD https://repo1.maven.org/maven2/com/google/googlejavaformat/google-java-format/${JAVA_FORMAT_VERSION}/google-java-format-${JAVA_FORMAT_VERSION}-all-deps.jar /owlbot/google-java-format.jar
 

docker/owlbot/nodejs/Dockerfile

@@ -26,7 +26,7 @@ RUN apt-get install -y nodejs
 
 ###################### Install synthtool's requirements.
 COPY requirements.txt /synthtool/requirements.txt
-RUN pip install -r /synthtool/requirements.txt
+RUN pip install --require-hashes -r /synthtool/requirements.txt
 
 # Put synthtool in the PYTHONPATH so owlbot.py scripts will find it.
 ENV PYTHONPATH="/synthtool"

docker/owlbot/nodejs_mono_repo/Dockerfile

@@ -26,7 +26,7 @@ RUN apt-get install -y nodejs
 
 ###################### Install synthtool's requirements.
 COPY requirements.txt /synthtool/requirements.txt
-RUN pip install -r /synthtool/requirements.txt
+RUN pip install --require-hashes -r /synthtool/requirements.txt
 
 # Put synthtool in the PYTHONPATH so owlbot.py scripts will find it.
 ENV PYTHONPATH="/synthtool"

docker/owlbot/php/Dockerfile

@@ -26,7 +26,7 @@ RUN apt-get install -y nodejs
 
 ###################### Install synthtool's requirements.
 COPY requirements.txt /synthtool/requirements.txt
-RUN pip install -r /synthtool/requirements.txt
+RUN pip install --require-hashes -r /synthtool/requirements.txt
 
 # Put synthtool in the PYTHONPATH so owlbot.py scripts will find it.
 ENV PYTHONPATH="/synthtool"

docker/owlbot/python/Dockerfile

@@ -34,7 +34,7 @@ RUN make altinstall
 
 ###################### Install synthtool's requirements.
 COPY requirements.txt /synthtool/requirements.txt
-RUN pip install -r /synthtool/requirements.txt
+RUN pip install --require-hashes -r /synthtool/requirements.txt
 
 # Put synthtool in the PYTHONPATH so owlbot.py scripts will find it.
 ENV PYTHONPATH="/synthtool"

requirements.in

@@ -0,0 +1,18 @@
+setuptools==65.0.1
+
+nox
+requests
+pyyaml
+jinja2
+deprecation
+protobuf==3.20.1
+watchdog
+
+# some java processing requires xml handling
+lxml
+
+# Install sample-tester for generated samples
+sample-tester
+
+# flake8 is used to validate the python samples noxfile template
+flake8