Replace pkg_resources with importlib.metadata

[frenck]

Fixes #441.

pkg_resources was removed in setuptools 82.0.0, so mqtt-io fails to import on any environment with a current setuptools:

File "mqtt_io/modules/__init__.py", line 12, in <module>
    import pkg_resources
ModuleNotFoundError: No module named 'pkg_resources'

Pinning setuptools below 82, as the development dependencies currently do, is not a way out. Every release that still ships pkg_resources is covered by GHSA-h35f-9h28-mq5c, so the pin trades an import error for a vulnerability report, and there is no version that is both usable and unaffected:

setuptools	ships pkg_resources	GHSA-h35f-9h28-mq5c
< 82	yes	vulnerable
82.x	no	vulnerable
>= 83	no	fixed

Distributions have moved on regardless. Alpine 3.24 already ships setuptools 82.0.1, so this is not something downstreams can pin their way around either.

pkg_resources was used in exactly one place, to work out whether a module's REQUIREMENTS are already installed. importlib.metadata and packaging do that directly, so this swaps the two out and lifts the setuptools pin along with them.

packaging is added as a dependency. It is pure Python, already present in most environments, and its Requirement parser is the same one pip uses.

Behaviour is unchanged. Checked against the installed set:

Case	Before and after
Requirement satisfied, bare name	no install attempted
Requirement satisfied, with specifier	no install attempted
Specifier not satisfied	install attempted
Package absent	install attempted
No REQUIREMENTS	no install attempted
Extras syntax, Pkg[extra]>=1.0	parsed, no install attempted

pylint -d fixme rates the module 10.00/10 and mypy --show-error-codes --strict --no-warn-unused-ignores reports no issues, matching what CI runs.

For context, this came up while updating the Home Assistant community app that packages mqtt-io. It is currently carrying this as a local patch, which I would happily drop.