Pin repos in requirements.txt to specific commits

Part of #701.

The only mySociety repo I haven't done is mapit, there we still just get the master branch. Should I pin that too? Is there a reason we're not getting it from pypi anyway?

Similarly, we still refer to django-mechanize without a specific commit, should I pin that too? I've not done it so far as the comment in #701 was specifically about those packages installed with the -e flag, but I'm happy to extend this if needs be. 

I could even make this a PR against #1142 if preferred?