Sanitize requirements files

The discussion on !345 (closed) made me notice that there are many places where requirements are set:

• conda-environment.yml
• requirements-conda.txt
• requirements-doc-conda.txt
• requirements-doc.txt
• requirements-pip.txt
• requirements-test-conda.txt
• setup.cfg
• Some dev requirenments such as black and bandit are not even in the above files and are only installed in the CI

Could @sfisher shed some light on the usage of these files ? What is the purpose of each ? Could we reduce their number ?