Wheel build should use a locked requirements file

[jwnimmer-tri]

Is your feature request related to a problem? Please describe.

In our wheel build, currently we install some unpinned dependencies:

drake/tools/wheel/macos/build-wheel.sh

Lines 112 to 115 in 82999cb

	pip install --upgrade \
	delocate \
	setuptools \
	wheel

drake/tools/wheel/image/provision-python.sh

Lines 41 to 54 in 82999cb

	# TODO(jwnimmer-tri): Should these be version-pinned? What's the process for
	# keeping them up to date if they are?
	pip install \
	matplotlib \
	numpy \
	pyyaml \
	semantic-version \
	setuptools \
	wheel \
	auditwheel
	if [[ "$(uname)" == "Linux" ]]; then
	pip install patchelf
	fi

This is a problem because it means our wheel builds are not reproducible (so checking out a Drake tag and building it might produce a different result, or even not work at all), and that broken uploads to PyPI can break our Nightly CI out from under us.

Describe the solution you'd like

• Compute requirements lockfile(s) for our wheel builds, so that the versions of everything we need are consistent across repeated builds of the same Drake source tree.
• Ensure that the lockfile is regularly refreshed (ala Monthly upgrades for venv lockfile #22041).

Describe alternatives you've considered

n/a

Additional context

At the moment, in non-wheel builds, we only have venv lockfiles for macOS. This issue should lock both the Linux wheel build and the macOS wheel build, i.e., the two code snippets above.

This is a sub-task of the #8392 epic.