Bump Werkzeug to version 2.0.2

This is the newest version.

Pyup is complaining about vulnerabilities in version 1.0.1, specifically
> Werkzeug version 2.0.2 improves the security of the debugger cookies.
> "SameSite" attribute is set to "Strict" instead of "None", and the
> secure flag is added when on HTTPS.

Previously we were using whatever version of Werkzeug that Flask
specified this pins it to get rid of the vulnerability without having to
upgrade everything at once.

This requires a few changes to tests which were relying on importing
`session` and `current_user` from Flask. Previously it seemed that
importing these in the tests referred to the same object that was being
used in the app. This appears to no longer be the case. This commit
works around that by:
- using a context manager to get the contents of the session, like we
  already do in most tests
- asserting that the mock which logs the user in is being called with
  the right values, rather than looking at the state of the
  `current_user` object (which was probably giving false certainty
  anyway)

tests/app/main/views/test_add_service.py

@@ -1,5 +1,5 @@
 import pytest
-from flask import session, url_for
+from flask import url_for
 from freezegun import freeze_time
 from notifications_python_client.errors import HTTPError
 
@@ -170,7 +170,8 @@ def test_should_add_service_and_redirect_to_tour_when_no_services(
         ),
         101,
     )
-    assert session['service_id'] == 101
+    with client_request.session_transaction() as session:
+        assert session['service_id'] == 101
 
 
 def test_add_service_has_to_choose_org_type(
@@ -283,7 +284,8 @@ def test_should_add_service_and_redirect_to_dashboard_when_existing_service(
         email_from='testing.the.post',
     )
     assert len(mock_create_service_template.call_args_list) == 0
-    assert session['service_id'] == 101
+    with client_request.session_transaction() as session:
+        assert session['service_id'] == 101
 
 
 @pytest.mark.parametrize('name, error_message', [