requirements.in: add requirements.in back for tracking pinned direct requirements

requirements.in: add requirements.in back for tracking pinned direct requirements

and update `update-requirements.sh` to use requirements.in for building
requirements.txt

for some install_requires versus requirements.txt, see
https://packaging.python.org/discussions/install-requires-vs-requirements/.
in an ideal world, we should have not put those non-essential dependencies in
``setup.py``.

Signed-off-by: Kefu Chai <kchai@redhat.com>