Fix issues from Nov 2022 security issue changes

[KSchopmeyer]

See commit message for details of changes

NOTE: Removed review needed because there is an issue with the build for python 3.10, ubuntu, minimum (test / test (ubuntu-latest, 3.10, minimum) and the development setup step hundreds of times too long (hours in place of seconds) when I finally killed that step. In a previous test it was in the development setup step for over an hour and not completed where all other tests completed the development setup step in about 30 seconds. Issue tied to pip issuing the following message for each item:

INFO: This is taking longer than usual. You might need to provide the dependency resolver with stricter constraints to reduce runtime. If you want to abort this run, you can press Ctrl + C to do so. To improve how pip performs, tell us what happened here: https://pip.pypa.io/surveys/backtracking

NOTE: Same issue occurs with local test using python 3.9 in local test of develop with PACKAGE_LEVEL=minimum.

The following is the safety table output defining the current safety issues from 1 November:

`
+============================+===========+==========================+==========+
| package | installed | affected | ID |
+============================+===========+==========================+==========+
| wheel | 0.30.0 | <0.38.0 | 51499 |
+==============================================================================+
| Wheel 0.38.0 fixes a potential DoS attack via the 'WHEEL_INFO_RE'
regular |
| expression.
|
+==============================================================================+
| wheel | 0.32.0 | <0.38.0 | 51499 |
+==============================================================================+
| Wheel 0.38.0 fixes a potential DoS attack via the 'WHEEL_INFO_RE'
regular |
| expression.
|
+==============================================================================+
| wheel | 0.33.5 | <0.38.0 |
51499 |
+==============================================================================+
| Wheel 0.38.0 fixes a potential DoS attack via the 'WHEEL_INFO_RE'
regular |
| expression.
|
+==============================================================================+
| safety | 1.8.7 | <2.2.0 | 51358 |
+==============================================================================+
| Safety 2.2.0 updates its dependency 'dparse' to include a security
fix. |
+==============================================================================+
| safety | 1.9.0 | <2.2.0 | 51358 |
+==============================================================================+
| Safety 2.2.0 updates its dependency 'dparse' to include a security
fix. |
+==============================================================================+
| py | 1.10.0 | <=1.11.0 | 51457 |
+==============================================================================+
| Py throughout 1.11.0 allows remote attackers to conduct a ReDoS
(Regular |
| expression Denial of Service) attack via a Subversion repository with
|
| crafted info data, because the InfoSvnCommand argument is mishandled.
|
| pytest-dev/py#287
|
+==============================================================================

[KSchopmeyer]

As shown by pr # 1230, which works when safety is limited to <2.2.0 it is the safety update to 2.2.0 that is causing the problems. IN particular, that safety update adds requirements for other update including click to 8.0.2 and dparse which leads to further issues. I finally tried update to pip and that is where an importlib-meta showed up but I do not know how we evaluate what the minimum level of pip should be:

DISCUSSION: I propose we accept this pr, kill off #1230 and write a new PR to push the upgrade of safety to 2.2.0 for next release. That gives us time to sort out the issues that are caused by the update to safety package.

I am open to alternatives.

[andy-maier]

See comment

[andy-maier]

On the long pip backtracking: When using pip 22.3.1 on Python 33.9 with minimum package levels, it detects a dependency conflict:

Collecting pywbem>=1.4.0
  Using cached pywbem-1.4.0-py2.py3-none-any.whl (396 kB)
ERROR: Cannot install -r dev-requirements.txt (line 49) and packaging>=17.0 because these package versions have conflicting dependencies.

The conflict is caused by:
    The user requested packaging>=17.0
    safety 2.2.0 depends on packaging>=21.0
    The user requested (constraint) packaging==17.0

To fix this you could try to:
1. loosen the range of package versions you've specified
2. remove package versions to allow pip attempt to solve the dependency conflict

ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

[coveralls]

Coverage remained the same at 92.949% when pulling b8303a9 on ks/nov-security-issues into 88401c5 on master.