Lock-down versions of provisioned software

We get random, irrelevant to Qt integration failures rather often caused by bogus updates to dependencies.

This is because we do zypper/pip/apt install blah_package in provisioning, and that latest version is broken.

This ticket is about locking all these versions.

It can happen in the following ways:

1. Either via text on the "install" command, e.g. pip install blah_package-3.0
2. or via mirroring all foreign repositories to local ones inside our CI, and updating the mirrors with a controlled process.

I personally prefer the 2nd method because it can be automated. Mirrors can be synced to upstream once every week. Of course after the test-mirrors are updated, a full CI run must pass with them before they are accepted into production.