fix(ci): use and fix pinned requirements

[dpgaspar]

Summary

PR #118 updated setup.py dependencies but left requirements.txt stale. This PR fixes that oversight:

• requirements.txt was outdated with elasticsearch==7.13.4 and missing opensearch-py entirely
• CI was using pip install -e . which masked the issue, but local development using requirements.txt would get wrong versions

Changes

requirements.txt

• elasticsearch==7.17.13 (was 7.13.4)
• opensearch-py==2.8.0 (was missing)
• sqlalchemy==2.0.29 (was 1.4.9)
• urllib3==2.2.2 (was 1.26.5)
• Added all transitive dependencies

setup.py

• Bumped opensearch-py>=2.8.0 (was >=2.4.0) - required because 2.8.0 is the first version supporting urllib3 2.x

.github/workflows/ci.yml

• Changed install order to use pinned requirements:

  pip install -r requirements.txt      # Pinned versions first
  pip install -r requirements-dev.txt  # Dev tools
  pip install -e .                     # Package in editable mode

Test plan

• pip install -r requirements.txt succeeds without dependency conflicts
• Linting passes (black, flake8, mypy)
• CI passes