Pin non-cb-auto dependencies in our plugin snaps (#8217)

This PR fixes our [Azure failures](https://dev.azure.com/certbot/certbot/_build/results?buildId=2492&view=results) by pinning our Python dependencies that are not included in certbot-auto.

This is done using the same approach as our [snap README](575092d603/tools/snap (build-the-snaps)) and [Docker images](575092d603/tools/docker/core/Dockerfile (L24-L25)) with some minor details changed to hopefully make the Python code more readable.

You can see tests passing with this change at https://dev.azure.com/certbot/certbot/_build/results?buildId=2495&view=results.

tools/snap/build_remote.py

@@ -6,6 +6,7 @@ from multiprocessing import Pool, Process, Manager, Event
 import re
 import subprocess
 import sys
+import tempfile
 from os.path import join, realpath, dirname, basename, exists
 
 
@@ -33,9 +34,14 @@ def _build_snap(target, archs, status, lock):
         workspace = CERTBOT_DIR
     else:
         workspace = join(CERTBOT_DIR, target)
-        subprocess.check_output(
-            ('"{0}" tools/strip_hashes.py letsencrypt-auto-source/pieces/dependency-requirements.txt '
-             '| grep -v python-augeas > "{1}/snap-constraints.txt"').format(sys.executable, workspace),
+        with tempfile.NamedTemporaryFile() as f:
+            subprocess.check_output(
+                ('"{0}" tools/strip_hashes.py letsencrypt-auto-source/pieces/dependency-requirements.txt '
+                 '| grep -v python-augeas > "{1}"').format(sys.executable, f.name),
+            shell=True, cwd=CERTBOT_DIR)
+            subprocess.check_output(
+                ('"{0}" tools/merge_requirements.py tools/dev_constraints.txt '
+                 '"{1}" > "{2}/snap-constraints.txt"').format(sys.executable, f.name, workspace),
             shell=True, cwd=CERTBOT_DIR)
 
     retry = 3