pin requirements with `pip freeze`

I mean, I think there's a strong case that redirecting `pip freeze` to a
file pins too much (by printing everything in your virtualenv, not just
your first-order dependencies; in contrast, Cargo, Bundler, &c. are
smart enough to distinguish), but it's better than not having any idea
what software was used to make the site.