Pin the poetry and tox version numbers to a know good set. Ensure that
we're using the most recent CI pipeline templates. The most recent (as
of writing) version of tox conflicts with the most recent poetry.

This commit changes no functionality but add pre-commit checks based on
our usual template and fixes up the code to match. Note that this found
a real bug in the type annotation for the override_permissions_spec
decorator.

Port packaging to poetry. This does not make any changes to the existing
test matrix or requirements.

We now have common Python project CI templates which, while continuing
to support PyPI publication, also allow for parallel matrix testing with
tox.

The GitLab CI configuration in this repo dates from a time before this
feature was in GitLab (as noted in the comments) and so had to work
around it by creating a lot of templated jobs.

Simplify the CI configuration by making use of the common template.