Pin flake8 to minor version

[ShadowJonathan]

Related to #9366

When talking about #9370, the issue of missing out on new features was dropped, when i was looking at the codebase again when working on #9499, i saw that flake8 had an unbound dependency constraint.

We could start having a similar problem like black, where a new version adding in new checks would break CI for a hot minute, because the current codebase does not match up with the lint's required checks.

This'd require taking notice of flake8 manually to update each minor version, but i think i can automate such things (i'm currently looking at https:/dependabot/dependabot-script)

[ShadowJonathan]

dependabot/dependabot-core#3202 is sorta related to this, need to fix that before detection of dependencies is possible in the first place, it seems

[DMRobertson]

Synapse now maintains a poetry lock file, and uses this to populate CI with pinned versions. (#11537)