Pin importlib-metadata

We can’t use the latest version of importlib-metadata because it’s
pinned to <4.3 by the newest version of flake8.

The conflict is caused by:
    The user requested importlib-metadata==4.8.1
    click 8.0.1 depends on importlib-metadata; python_version < "3.8"
    pytest 6.2.5 depends on importlib-metadata>=0.12; python_version < "3.8"
    flake8 4.0.1 depends on importlib-metadata<4.3; python_version < "3.8"

Our `make freeze-requirements` task doesn’t catch this because it
doesn’t look at dependencies in `requirements-for-test.txt`. Therefore
it only freezes the version that `click` is specifying, which is the
latest version.

Pinning the version in `requirements.in` gets around this.

requirements.in

@@ -22,6 +22,7 @@ notifications-python-client==6.2.1
 Shapely==1.7.1
 rtreelib==0.2.0
 fido2==0.9.1
+importlib-metadata==4.2.0
 
 # PaaS
 awscli-cwlogs>=1.4,<1.5

requirements.txt

@@ -87,8 +87,10 @@ humanize==3.6.0
     # via -r requirements.in
 idna==2.10
     # via requests
-importlib-metadata==4.6.1
-    # via click
+importlib-metadata==4.2.0
+    # via
+    #   -r requirements.in
+    #   click
 itsdangerous==1.1.0
     # via
     #   -r requirements.in