Pin pupa and opencivicdata

[hancush]

In the past, we've installed from master because we wanted to capture changes before they were rolled into a release. We are now the maintainers of these repositories and can cut releases at will. Consider pinning dependencies to a particular version (or minor version series, so we can auto-capture patches but don't have to worry about breaking changes).