Do not accept requires_dist: null from JSON API

[uranusjr]

Related to #40.

This will induce an overhead to packages with empty requirements, and some of those can be quite significant. I can’t think of a better way to work around this quirk, unfortunately.

Some example packages:

• numpy. It has wheels, so PyPI should be able to read dependencies, but its requires_dist is still null. In reality it does not have any dependencies at all.
• apache-airflow. It has tons of dependencies, but PyPI fails to read it, and reports its requires_dist as null.

So this PR plays it safe and always fall back when JSON reports null. The local dependency cache will be relied on to reduce overhead in cases like numpy.

[techalchemy]

Thanks for doing this. I’m on vacation for another day but I apparently have to get home for that and just get stuff together because we are getting hit by a serious hurricane.

For #40 some other things are not working, but we can consider dropping the pep 517 thing for now. Then at least it could build sdists if needed

[uranusjr]

I’m thinking maybe I can partially reimplement it. We really only need the build metadata hook anyway. I plan to peek into that pep517 library and work on it today (maybe in another branch).