Replace safety with pip audit
https://github.com/pyupio/safety is updated only once per month (you have to pay to have more frequent updates). https://github.com/pypa/pip-audit has fewer stars (684 against 1.4k) but use open data and is maintained by https://github.com/pypa.

Note that we upgrade poetry to 1.2.2 in this PR.

We have some issues with pip-audit (see below), and the fixes are a bit hacky (editing the requirements.txt file with `sed`). Ideally, it would be managed in a proper poetry plugin (see https://github.com/opeco17/poetry-audit-plugin/ for a plugin based on safety), but I think it's not worth creating a new repo for now.

---

Some notes:
- pip-audit suggests poetry to add `poetry audit`: https://github.com/pypa/pip-audit/issues/84
- poetry suggests people that want to audit their dependencies to use `pip-audit` or to create a poetry plugin to do so: https://github.com/python-poetry/poetry/issues/6220
- a poetry plugin called https://github.com/opeco17/poetry-audit-plugin is based on safety, not pip-audit

That's why we do:

```bash
bash -c 'poetry run pip-audit -r <(poetry export -f requirements.txt --with dev)'
```

We still have an issue, though: the requirements.txt file contains duplicates when the same package is required both with and without "extras", e.g. with requests (which is not considered a bug by poetry: https://github.com/python-poetry/poetry-plugin-export/issues/129, https://github.com/python-poetry/poetry-plugin-export/issues/157, reason: https://github.com/python-poetry/poetry/pull/5688#issuecomment-1137845130):

```
requests==2.28.1 ; python_full_version == "3.9.6" \
    --hash=sha256:7c5599b102feddaa661c826c56ab4fee28bfd17f5abca1ebbe3e7f19d7c97983 \
    --hash=sha256:8fefa2a1a1365bf5520aac41836fbee479da67864514bdb821f31ce07ce65349
requests[socks]==2.28.1 ; python_full_version == "3.9.6" \
    --hash=sha256:7c5599b102feddaa661c826c56ab4fee28bfd17f5abca1ebbe3e7f19d7c97983 \
    --hash=sha256:8fefa2a1a1365bf5520aac41836fbee479da67864514bdb821f31ce07ce65349
```

but pip-audit fails in this case:

```
ERROR:pip_audit._cli:package requests has duplicate requirements: requests[socks]==2.28.1 (from RequirementLine(line_number=1992, line='requests[socks]==2.28.1 ; python_full_version == "3.9.6"     --hash=sha256:7c5599b102feddaa661c826c56ab4fee28bfd17f5abca1ebbe3e7f19d7c97983     --hash=sha256:8fefa2a1a1365bf5520aac41836fbee479da67864514bdb821f31ce07ce65349', filename=PosixPath('/dev/fd/63')))
```

I added a comment here: https://github.com/pypa/pip-audit/issues/84#issuecomment-1326203111
Replace safety with pip audit: https://github.com/pyupio/safety is updated only once per month (you have to pay to have more frequent updates). https://github.com/pypa/pip-audit has fewer stars (684 against 1.4k) but use open data and is maintained by https://github.com/pypa.

Note that we upgrade poetry to 1.2.2 in this PR.

We have some issues with pip-audit (see below), and the fixes are a bit hacky (editing the requirements.txt file with `sed`). Ideally, it would be managed in a proper poetry plugin (see https://github.com/opeco17/poetry-audit-plugin/ for a plugin based on safety), but I think it's not worth creating a new repo for now.

---

Some notes:
- pip-audit suggests poetry to add `poetry audit`: https://github.com/pypa/pip-audit/issues/84
- poetry suggests people that want to audit their dependencies to use `pip-audit` or to create a poetry plugin to do so: https://github.com/python-poetry/poetry/issues/6220
- a poetry plugin called https://github.com/opeco17/poetry-audit-plugin is based on safety, not pip-audit

That's why we do:

```bash
bash -c 'poetry run pip-audit -r <(poetry export -f requirements.txt --with dev)'
```

We still have an issue, though: the requirements.txt file contains duplicates when the same package is required both with and without "extras", e.g. with requests (which is not considered a bug by poetry: https://github.com/python-poetry/poetry-plugin-export/issues/129, https://github.com/python-poetry/poetry-plugin-export/issues/157, reason: https://github.com/python-poetry/poetry/pull/5688#issuecomment-1137845130):

```
requests==2.28.1 ; python_full_version == "3.9.6" \
    --hash=sha256:7c5599b102feddaa661c826c56ab4fee28bfd17f5abca1ebbe3e7f19d7c97983 \
    --hash=sha256:8fefa2a1a1365bf5520aac41836fbee479da67864514bdb821f31ce07ce65349
requests[socks]==2.28.1 ; python_full_version == "3.9.6" \
    --hash=sha256:7c5599b102feddaa661c826c56ab4fee28bfd17f5abca1ebbe3e7f19d7c97983 \
    --hash=sha256:8fefa2a1a1365bf5520aac41836fbee479da67864514bdb821f31ce07ce65349
```

but pip-audit fails in this case:

```
ERROR:pip_audit._cli:package requests has duplicate requirements: requests[socks]==2.28.1 (from RequirementLine(line_number=1992, line='requests[socks]==2.28.1 ; python_full_version == "3.9.6"     --hash=sha256:7c5599b102feddaa661c826c56ab4fee28bfd17f5abca1ebbe3e7f19d7c97983     --hash=sha256:8fefa2a1a1365bf5520aac41836fbee479da67864514bdb821f31ce07ce65349', filename=PosixPath('/dev/fd/63')))
```

I added a comment here: https://github.com/pypa/pip-audit/issues/84#issuecomment-1326203111