Unpin requirements.txt

This issue can be used as a continuation of #133 which I inadvertently (and irreversibly) closed when deleting the master branch in favor of the new main default branch.

Please read ALL of #133 before commenting here.

[jorisroovers]

As we’re getting close to getting #246 merged, I wanted to leave a note of appreciation for @andersk for getting us out of this impasse. You both came up with multiple suggestions (after taking the time to understand my perspective), and then also followed through and did the implementation. Thank you - gitlint is better because of it!

And @sigmavirus24 of course, for perspective and expertise (always 😃 )

Thank you!

[andersk]

Unfortunately, the Python packaging system doesn’t support extras that loosen dependencies rather than tightening them, nor does it support default extras (pypa/setuptools#1139).

A possible workaround would be to rename the main package to (say) gitlint-core, and have gitlint be an empty package that just requires gitlint-core[trusted-deps]. But I’m not sure if maintaining two packages rather than one would be an improvement from your perspective, even if one is empty?

Alternatively, what do you think about simply adding a question to the GitHub issue template asking whether the user installed with pip install gitlint[trusted-deps] as documented, and/or asking for the output of pip freeze?