Remove unused .ini directives and clean up deps

With this change, setup.py should be sufficient to get h running with the
sole exception of pyramid_webassets, which has a release coming soon.

I only pinned to exact versions where I think there's a reasonable chance
of an upgrade breaking something soon, or where there are known issues. For
instance, d3.js has unicode characters that break webassets 0.9. Another is
selenium, for which 2.41.0 seems to break the tests.

I really think there should be some best practice here that I'm missing, but
for now I've tried to just use >= wherever possible and == when necessary.