Replace deprecated usage of pkg_resources

[miketheman]

setuptools has deprecated their pkg_resources sub-package in favor of stdlib packages. See https://setuptools.pypa.io/en/latest/pkg_resources.html

We appear to use it on only a few places:

$ git grep pkg_resources
tests/unit/forklift/test_legacy.py:import pkg_resources
tests/unit/forklift/test_legacy.py:                project.name, pkg_resources.safe_name(project.name).lower()
warehouse/forklift/legacy.py:import pkg_resources
warehouse/forklift/legacy.py:    prefix = pkg_resources.safe_name(project.name).lower()
warehouse/forklift/legacy.py:    if not pkg_resources.safe_name(filename).lower().startswith(prefix):
warehouse/utils/readme.py:import pkg_resources
warehouse/utils/readme.py:    return pkg_resources.get_distribution("readme-renderer").version

I'm not certain where to best find a replacement for safe_name() yet. We might have existing comparable functionality in warehouse already.
Feel free to omit this from the refactor if it's too complex.

A similar refactor took place in readme-renderer, see pypa/readme_renderer#281 for details.

---

Good First Issue: This issue is good for first time contributors. If you've already contributed to Warehouse, work on another issue without this label instead. If there is not a corresponding pull request for this issue, it is up for grabs. For directions for getting set up, see our Getting Started Guide.

If you are working on this issue and have questions, feel free to ask them here, in the #pypa-dev chat channel on Libera, the PyPA Discord or on the Discourse.

Screenshot Required: If your pull request makes a visual change, include a screenshot of your update. This helps our team give you feedback faster.

[di]

I think that changing the behavior where we use safe_name basically amounts to fixing #10030, which is a considerably bigger lift than just switching to a stdlib equivalent, so that might not be "good first issue" material.

The change where we use get_distribution should be straightforward, though!