Pin versions

Selected the version of setuptools_scm somewhat arbitrarily. This is a bit of a quick fix; preferably someone should replace the build system.

I also pinned some "vulnerable" packages where the maintainers might break py3.6 support without giving notice.