Pin requests-toolbelt>=1 to unbreak requests==2.30

[gordonhart]

Recommended by the requests maintainers in psf/requests#6443. Left a TODO to remove — this pin seems like the right solution for us to apply in the short term, but longer term we really don't want to be pinning transient dependencies.

Opted to pin requests-toolbelt to the new major version instead of pinning transient urllib3. This appears to address the issue without requiring a transient dependency pin. It's not ideal to force users to pick up a very-new version of requests-toolbelt, but that is a very small package and the 1.0 release is quite innocuous.

[codecov]

Codecov Report

Merging #8 (0094a1f) into trunk (1590494) will increase coverage by 85.51%.
The diff coverage is n/a.

❗ Current head 0094a1f differs from pull request most recent head 4b821d7. Consider uploading reports for the commit 4b821d7 to get more accurate results

@@            Coverage Diff             @@
##           trunk       #8       +/-   ##
==========================================
+ Coverage       0   85.51%   +85.51%     
==========================================
  Files          0       93       +93     
  Lines          0     5863     +5863     
  Branches       0      640      +640     
==========================================
+ Hits           0     5014     +5014     
- Misses         0      767      +767     
- Partials       0       82       +82     

see 93 files with indirect coverage changes

[gordonhart]

I'm getting different issues on different environments with this strict requests-toolbelt>=1 pin. Going to update to add an upper bound requests<2.30 instead, giving the ecosystem some time to adapt to this breaking change.