Add a lower bound for the version of setuptools

[jsf9k]

🗣 Description

This pull request adds a lower bound for the version of setuptools.

💭 Motivation and context

This is done in response to a recently-discovered vulnerability in setuptools:

• https://security.snyk.io/vuln/SNYK-PYTHON-SETUPTOOLS-3113904
• [BUG] Inefficient Regex pypa/setuptools#3659
• https://cwe.mitre.org/data/definitions/1333.html

It should also get rid of a zillion Snyk PRs like this that are polluting our repos.

🧪 Testing

All automated tests pass.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

[dav3r]

🔐

[mcdonnnj]

I'm not sure about investing in version pinning this kind of dependency simply because a fresh install or an upgrade install will pull down the appropriate package, the vulnerability is a self-DoS, and the new version is not specifically required for functionality. If we do want to proceed with this kind of pinning then we need to add an ignore directive (with attribution0 here

skeleton-generic/.github/dependabot.yml

Lines 23 to 26 in e803e1a

	- package-ecosystem: "pip"
	directory: "/"
	schedule:
	interval: "weekly"

in line with how we manage other pinned dependencies.

[jsf9k]

Closed due to @mcdonnnj's compelling argument.