bump requirements

also pyup ignore awscli and botocore because that complex mesh of
dependency hell doesn't play will with pyup opening a new PR every time
that botocore/awscli update (every few days)

requirements-app.txt

@@ -6,7 +6,7 @@ celery==3.1.26.post2 # pyup: <4
 docopt==0.6.2
 Flask-Bcrypt==0.7.1
 flask-marshmallow==0.9.0
-Flask-Migrate==2.2.1
+Flask-Migrate==2.3.0
 Flask-SQLAlchemy==2.3.2
 Flask==1.0.2
 click-datetime==0.2
@@ -15,7 +15,7 @@ gunicorn==19.7.1
 iso8601==0.1.12
 jsonschema==2.6.0
 marshmallow-sqlalchemy==0.14.1
-marshmallow==2.15.6
+marshmallow==2.16.0
 psycopg2-binary==2.7.5
 PyJWT==1.6.4
 SQLAlchemy==1.2.12
@@ -23,9 +23,9 @@ SQLAlchemy==1.2.12
 notifications-python-client==5.2.0
 
 # PaaS
-awscli==1.15.82
+awscli==1.15.82  # pyup: ignore
 awscli-cwlogs>=1.4,<1.5
-botocore<1.11.0
+botocore<1.11.0  # pyup: ignore
 
 git+https://github.com/alphagov/notifications-utils.git@30.5.5#egg=notifications-utils==30.5.5