proposal: add `pins` argument to `Venv` to allow specifying version pins

[P403n1x87]

By design, the virtual env layering of riot is such that child virtual envs override parent ones. This means that declaring a pin as a dependency in the pkgs argument of a parent virtual env won't actually pin the dependency if this is installed in a child virtual env. To allow for adding pins to a parent virtual env so that they could be shared by the children, we could introduce the pins argument, which bubbles up all the pins up to the leaf virtual env, thus ensuring that the pin constraints are enforced.

Note that we still wouldn't have any compatibility checks even with this change.