fix: pin CI build dependencies (cmake & ninja)

[mayeut]

Prevents a race condition on release, ensures reproducibility.

relates to #159

[mayeut]

Build will need to be triggered again on travis-ci once there are credits available again.

[henryiii]

Do you think we could drop these in a requirements file and then use dependabot to keep it updated? That's the "good" use for requirements files. :)

[mayeut]

Do you think we could drop these in a requirements file and then use dependabot to keep it updated? That's the "good" use for requirements files. :)

That's definitely doable as long as we don't require hashes (c.f. pypa/pipx#712)

[mayeut]

Do you think we could drop these in a requirements file and then use dependabot to keep it updated? That's the "good" use for requirements files. :)

Now done.
I used a constraint file rather than requirements*.txt as it is used as a constraint file.
It only includes cmake & ninja for now. cibuildwheel could be added later for Travis CI for example (or twine for pipx run twine ...).

There was an issue with manylinux images pipx wrapper pypa/manylinux#1131 found when investigating
pypa/pipx#712 that required to update all manylinux images in pyproject.toml

[thewtex]

👍