Data pipeline packaging updates

[sjahl]

At some point during the 4.0 release, we attempted to switch the data pipeline to fully-locked dependencies with poetry. I think (?) for various reasons this caused some grief with getting things installed in dataproc, so that didn't work out and we abandoned it.

We have three things that should be sorted:

• Decide if we should still use poetry for the data-pipeline script itself that we run locally (e.g. not the reqs that get passed to dataproc)
• Remove poetry or replace it with another package locking tool
• Address the proposed Hail update that dependabot wants (and, optionally ignore Hail updates if we don't want dependabot trying to update it)

[nadeaujoshua]

Just a quick note, I think we discussed the first bullet in a few stand-ups during my updates, and agreed to remove poetry. So I actually did the second bullet (removal) in this branch, which will have a PR soon.