Set module hashes in requirements files

Improvement 1

We are currently simply listing what module we need and its version.
To prevent security breaches and distributing binaries containing malwares, we must set the packages hashes.

Typically:

nuxeo==2.2.1

becomes:

nuxeo==2.2.1 --hash=sha256::411522057e02eaad32e9983becdaec5166351f744733ab939557f3b8d8d8965f

Improvement 2

We must expand requirements files to list submodules and their hashes to ensure no unchecked submodule can be compromised too.
And we need to ensure pip is installing only modules we are asking for.