Use pipenv sync to only install from lock (canada-ca#61)

* Use pipenv sync to only install from lock

Using sync to install packages exactly as specified in Pipfile.lock.

* Add updated lockfile

Our builds were apparently succeeding by pipenv install adding a library
(importlib_metadata) to the lockfile during build.
Switching to use pipenv sync made for a reproducible build but revealed
the missing library.

Author: sleepycat

api/Pipfile.lock

@@ -16,7 +16,7 @@ steps:
     id: install
     dir: api
     entrypoint: pipenv
-    args: ['install', '-d', '--skip-lock']
+    args: ['sync', '-d', '--bare']
     env:
       - PIPENV_NOSPIN=TRUE
 

api/cloudbuild.yaml

@@ -16,7 +16,9 @@ steps:
     id: install
     dir: web
     entrypoint: pipenv
-    args: ['install', '-d']
+    args: ['sync', '-d', '--bare']
+    env:
+      - PIPENV_NOSPIN=TRUE
 
   - name: 'gcr.io/track-compliance/ci'
     id: test