fix: preserve explicit project dependencies versions when installing tools

Prevent the Python template from forcing upgrade (--upgrade) when installing tools (ex: bandit, pytest, nose, ...).
Thus, if those tools are declared as project development dependencies with explicit versions, those versions will be respected

templates/gitlab-ci-python.yml

@@ -212,7 +212,7 @@ variables:
       if  [[ ! -f "poetry.lock" ]]; then
         log_warn "Poetry detected but \\e[33;1mpoetry.lock\\e[0m file not found: you shall commit it with your project files"
       fi
-      pip install -U poetry
+      pip install poetry
       if [[ "$target" == "build" ]]; then
         log_info "--- Poetry detected: install build only requirements"
         poetry install --no-dev ${PYTHON_POETRY_EXTRAS:+--extras "$PYTHON_POETRY_EXTRAS"}
@@ -242,7 +242,7 @@ variables:
     if [[ -f "pyproject.toml" ]] && [[ "${PYTHON_POETRY_DISABLED}" != "true" ]]; then
       if ! command -v poetry > /dev/null
       then
-        pip install -U poetry
+        pip install poetry
       fi
       poetry run "$@"
     else
@@ -260,20 +260,20 @@ variables:
 
   function _package(){
      if [[ -f "pyproject.toml" ]] && [[ "${PYTHON_POETRY_DISABLED}" != "true" ]]; then
-      pip install -U poetry
+      pip install poetry
       poetry build
     else
+      pip install setuptools
       python setup.py sdist bdist_wheel
     fi
   }
-
   function _publish() {
     if [[ -f "pyproject.toml" ]] && [[ "${PYTHON_POETRY_DISABLED}" != "true" ]]; then
-      pip install -U poetry
+      pip install poetry
       poetry config repositories.user_defined  "$TWINE_REPOSITORY_URL"
       poetry publish --username "$TWINE_USERNAME" --password "$TWINE_PASSWORD" --repository user_defined
     else
-      pip install -U twine setuptools
+      pip install twine
       pip list
 
       twine upload --verbose dist/*.tar.gz
@@ -283,10 +283,10 @@ variables:
 
   function _release() {
     if [[ -f "pyproject.toml" ]] && [[ "${PYTHON_POETRY_DISABLED}" != "true" ]]; then
-      pip install -U poetry
+      pip install poetry
       poetry version "${RELEASE_VERSION_PART}"
     else
-      pip install -U bumpversion
+      pip install bumpversion
       release_args
       bumpversion "${bumpversion_args}"
     fi
@@ -372,7 +372,7 @@ py-lint:
     - mkdir -p reports
     - chmod o+rwx reports
     - install_requirements build
-    - _pip install -U pylint_gitlab
+    - _pip install pylint_gitlab
     - |
       if ! _run pylint --ignore=.cache --output-format=text  ${PYLINT_ARGS}  ${PYLINT_FILES:-$(find -type f -name "*.py")}
       then
@@ -427,9 +427,9 @@ py-unittest:
     - chmod o+rwx reports
     - install_requirements test
     # code coverage
-    - _pip install -U coverage
+    - _pip install coverage
     # JUnit XML report
-    - _pip install -U unittest-xml-reporting
+    - _pip install unittest-xml-reporting
     - _run coverage run -m xmlrunner discover -o "reports/" $UNITTEST_ARGS
     - _run coverage report -m
     - _run coverage xml -o "reports/coverage.xml"
@@ -458,7 +458,7 @@ py-pytest:
     - mkdir -p reports
     - chmod o+rwx reports
     - install_requirements test
-    - _pip install -U pytest pytest-cov coverage
+    - _pip install pytest pytest-cov coverage
     - _python -m pytest --junit-xml=reports/TEST-pytests.xml --cov --cov-report term  --cov-report xml:reports/coverage.xml ${PYTEST_ARGS}
   coverage: /^TOTAL.+?(\d+\%)$/
   artifacts:
@@ -513,7 +513,7 @@ py-bandit:
   script:
     - mkdir -p reports
     - chmod o+rwx reports
-    - _pip install -U bandit
+    - _pip install bandit
     - |
       if ! _run bandit ${TRACE+--verbose} ${BANDIT_ARGS}
       then