Use pipenv when updating dependencies

If there is a Pipfile in the repo, we'll use pipenv rather than poetry.

• test this! It's not tested.
• decide whether we should open pyproject.toml and look at whether the build system is set to poetry or setuptools. That is harder from a simple shellscript though, and I think the presence/absence of Pipfile should be enough; I don't think there is any reason Pipfile would exist, if we are not using pipenv.