build: Use hatchling (or get rid of setuptools_scm anyway)

[jku]

setuptools_scm tries to be way more smart than it should and breaks pip install git+https://github.com/jku/securesystemslib.git which is useful for testing PR branches in downstream projects. Specifically it imagines the git tag 'debian/0.16.0-1' is a version number and asserts because it doesn't quite work.

I suggest we get rid of setuptools_scm...

• we currently use it for automated version setting from git describe (and I sort of like that -- getting development version numbers for free is nice)
• hatchling has VCS support as well, so could just switch to hatchling (since I think that was the plan anyway) and hope the VCS support is better
• if VCS support is found to be a bad idea, hatchcling can read the version from __init__.py

[jku]

lol hatch-vcs actually uses setuptools-scm internally so we get the same bug 😂

So we don't get nice toys then: let's remove VCS integration and add version number into __init__py