bump lxml to fix security warning

two vulnerabilities in <4.6.5 (GHSL-2021-1037 and GHSL-2021-1038)
https://github.com/lxml/lxml/blob/master/CHANGES.txt

also removes docopt as we don't use it except for a dev script (which we
might not need anyway)

requirements.in

@@ -3,7 +3,6 @@
 
 cffi==1.14.5
 celery[sqs]==5.2.0
-docopt==0.6.2
 Flask-Bcrypt==0.7.1
 flask-marshmallow==0.14.0
 Flask-Migrate==2.7.0
@@ -24,7 +23,7 @@ strict-rfc3339==0.7
 rfc3987==1.3.8
 cachetools==4.2.1
 beautifulsoup4==4.9.3
-lxml==4.6.3
+lxml==4.7.1
 Werkzeug==2.0.2
 
 # higher version causes build to fail on PaaS due to lack of Rust