WORKSPACE: rules_python->0.13; switch to hermetic interpreter

Change-Id: I0145f9db6a71fa9080b166dd75ff2c1b93e2b241
Reviewed-on: https://gerrit.hackerspace.pl/c/hscloud/+/1462
Reviewed-by: q3k <q3k@hackerspace.pl>

WORKSPACE

@@ -18,10 +18,10 @@ load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 
 protobuf_deps()
 
-rules_python_version = "0.11.0"
+rules_python_version = "0.13.0"
 http_archive(
     name = "rules_python",
-    sha256 = "c03246c11efd49266e8e41e12931090b613e12a59e6f55ba2efd29a7cb8b4258",
+    sha256 = "8c8fe44ef0a9afc256d1e75ad5f448bb59b81aba149b8958f02f7b3a98f5d9b4",
     strip_prefix = "rules_python-{}".format(rules_python_version),
     url = "https://github.com/bazelbuild/rules_python/archive/refs/tags/{}.tar.gz".format(rules_python_version),
 )
@@ -60,15 +60,23 @@ load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
 bazel_skylib_workspace()
 
 # Python rules
+load("@rules_python//python:repositories.bzl", "python_register_toolchains")
+
+python_register_toolchains(
+    name = "python3_10",
+    python_version = "3.10",
+)
+
+load("@python3_10//:defs.bzl", "interpreter")
 load("@rules_python//python:pip.bzl", "pip_parse")
 
 pip_parse(
     name = "pydeps",
+    python_interpreter_target = interpreter,
     requirements_lock = "//third_party/py:requirements.txt",
 )
 
 load("@pydeps//:requirements.bzl", "install_deps")
-
 install_deps()
 
 # Setup Go toolchain.

third_party/py/requirements.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with python 3.11
+# This file is autogenerated by pip-compile with python 3.10
 # To update, run:
 #
 #    bazel run //third_party/py:requirements.update
@@ -520,6 +520,12 @@ zope-interface==5.4.0 \
     --hash=sha256:f7ee479e96f7ee350db1cf24afa5685a5899e2b34992fb99e1f7c1b0b758d263
     # via gevent
 
-# WARNING: The following packages were not pinned, but pip requires them to be
-# pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag.
-# setuptools
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==67.1.0 \
+    --hash=sha256:a7687c12b444eaac951ea87a9627c4f904ac757e7abdc5aac32833234af90378 \
+    --hash=sha256:e261cdf010c11a41cb5cb5f1bf3338a7433832029f559a6a7614bd42a967c300
+    # via
+    #   gevent
+    #   gunicorn
+    #   zope-event
+    #   zope-interface