remove pinned versions from requirements.txt

[jmanecke]

It doesn't make sense to have pinned dependencies in requirements.txt file as this a demo app. Pinned versions can result in the problem we have now were dependencies are out of sync.

• removed pinned version from flask-session and flask-oauthlib
  • if flask is left unpinned, then these should be too
• removed pinned version for xero-python
  • the pin at 1.5.3 was very old, the package is up to v 7.0.1
  • checked against python 3.9 and above (all versions not EOL) and all work with latest xero-python (7.0.1)

Updates to the README.md file increase likelihood of success following the instructions

• add step to upgrade pip and tools as some earlier versions can't install xero-python (even version 1.5.3)
• changed to specify python 3.9 and higher as anything lower is EOL so really shouldn't include it