poetry env was failing on click-default-group, which is unmaintained and
apparently used a long-deprecated setuptools component. Today's
setuptools update removed it, which broke installation.
Fortunately, we don't need click-default-group for anything, and neither
does towncrier (which pulled in that dep), whose maintainers cleverly
realized _last year_ that they'd better vendor the package.
Updating towncrier seems to fix the problem.
Also bumping locked version of requests because poetry complains that
the locked one was yanked...