Remove unused .ini directives and clean up deps

With this change, setup.py should be sufficient to get h running with the
sole exception of pyramid_webassets, which has a release coming soon.

I only pinned to exact versions where I think there's a reasonable chance
of an upgrade breaking something soon, or where there are known issues. For
instance, d3.js has unicode characters that break webassets 0.9.

I really think there should be some best practice here that I'm missing, but
for now I've tried to just use >= wherever possible and == when necessary.