Fix dependencies

Rationale:

• Pips new resolver is stricter about versioning conflicts and takes a lot of time to backtrack and compare different package versions if no constraints are provided.
• importlib_metadata is only used as backport of importlib.metadata for Python 3.7. importlib_metadata > 1.4 contains features only present in Python >=3.10. Thus, setup.cfg should contain importlib_metadata==1.4.

Side effects:

• We need a dependency checker in the CI that fails when using old package versions on master (or something similar). Else, it would be too easy to update dependency versions.