pip req version specifier order is non-deterministic, breaking content_hash

[maresb]

If I have an environment.yml with

...
- pip
- pip:
  - some-pypi-package >=1.2.3,<2.0.0

then the content_hash is half-of-the-time based on an env_spec with >=1.2.3,<2.0.0 and the other half with <2.0.0,>=1.2.3.

Similar bugs that I have seen all result from a Python set is being used, because it orders elements randomly.

Note: for whoever manages to work on this, it may be worthwhile to also look into #273 since it also deals with aggregation of version specifiers on PyPI packages.