Stop importing packaging in the distro; vendor a dependency-free replacement

[ocelotl]

What

Removes the distribution's own runtime use of packaging. The injector bootstrap script (sitecustomize.py) used packaging.Requirement/packaging.Version for its dependency-conflict check, which made the distro's own code depend on packaging being importable in the injected process.

Following the approach in open-telemetry/opentelemetry-python-contrib#4883, this vendors that PR's small PEP 440/508 implementation into the distro at dash0.opentelemetry.injector._packaging and imports Requirement/Version from there instead. The copy is verbatim except for rewritten internal import paths.

⚠️ Temporary — to be removed

This vendored copy is to be removed once the same local implementation is added to opentelemetry-instrumentation. Vendoring (rather than importing opentelemetry.instrumentation._packaging directly) is deliberate: the upstream removal (contrib #4883) is not guaranteed to land. Once opentelemetry-instrumentation ships _packaging in a release this distribution pins, delete the vendored package together with its tests/test_packaging_*.py and repoint the imports in sitecustomize.py (and the tests) to opentelemetry.instrumentation._packaging.

This note is recorded in-code in dash0/opentelemetry/injector/_packaging/__init__.py and at the sitecustomize.py import site.

Notes

• sitecustomize.py uses SpecifierSet.contains() rather than the in operator, matching upstream — the vendored specifiers deliberately do not implement __contains__.
• The two tests that imported packaging (test_sitecustomize.py, test_instrumentations.py) now import from the vendored module; the upstream test_packaging_* tests are included. The vendored code and its tests are excluded from ruff, as with the other vendored packages.
• The packaging == 26.2 pin in pyproject.toml and the verify_pyproto.py allowlist stay: packaging is still pulled in transitively via opentelemetry-instrumentation, so check_pinned_dependencies still requires it declared. Both can be removed once that transitive dependency is gone (contrib #4883 + #4884-4887 and a distro version bump).
• Distro version bumped 0.3.1 → 0.3.2 (packaged files changed).

Refs #48