UX for constraining build-time and runtime dependencies

まだ誰も着手していません。

There is a practical UX problem with `pyproject.toml` that we need to solve. A short description would be:
- Any project that builds against the `numpy` C API has to deal with API and ABI compatibility (see [the numpy docs on that](https://numpy.org/devdocs/user/depending_on_numpy.html?highlight=abi#adding-a-dependency-on-numpy) for details).
- as a consequence, the dependency specification for local development is different from the one needed for uploading an sdist to PyPI:
- for local development, you want loose dependencies, e.g. `numpy >= 1.19.5` (both a build and runtime dep)
- in sdist released to PyPI you want: `oldest-supported-numpy` (build dep metapackage, contains `==` pins per platform) and `numpy>='buildtime_dep,<1.25.0' # should be `N+3` where `N is current minor version.

That is obviously a complex set of dependencies to express in `pyproject.toml`, and we can't have two sets in there at the same time. The solution @FFY00 and I just discussed is:

1. On the `main` branch, use the loose development dependencies (`numpy>=1.19.5`)
2. In the CI job(s) that produce artifacts for release to PyPI, ensure that the _lowest_ supported dependencies (which may be platform-dependent) are installed.
3. In the _release_ branch, replace the dependencies with the build-time deps needed for uploading to PyPI.
4. Have support in `mesonpy` for the various kinds of pinnings people need for releases and API/ABI compatibility.

A rough sketch of how (4) could look:

```toml
[build-system]
requires = [
"numpy >= 1.19.5", # replace with (e.g.) `oldest-supported-numpy` in a release branch
]

[tool.mesonpy]
runtime_pinnings = [
# if build version detected is 1.20.3, replace with `>=1.20.3` (while preserving the upper bound,
# so end result would be for example `'>=1.20.3,<1.25.0')
"numpy = 'pin_compatible'",
"pythran = 'bugfix_only'", # if build version detected is 0.10.0, override the build dependency with `'>=0.10.0,<0.11.0'`
"torch = 'exact'", # runtime version must equal build-time version (PyTorch has no ABI stability guarantees)
]
```

Note that this feature is needed for some other packages than just NumPy too (basically every package offering a C/C++ API has to deal with this), but NumPy alone is important enough - every package containing even a single Cython extension which uses NumPy has to deal with this. _However_, it's probably still a bit too specific to want native support in `pyproject.toml` via a standard that all tools must implement. Hence the choice to put this in `mesonpy`.

まず、提案されている pyproject.toml の設定と、issue で説明されている mesonpy のサポートを確認します。ビルド時の依存関係、runtime_pinnings、release ブランチでの依存関係の変更がどのように相互作用するかを追跡します。報告ではソースファイルやテストは指定されていません。完了条件は、NumPy、bugfix-only、および正確な runtime 依存関係に対する pinning の動作を定義して実装し、release ビルドを対象とするカバレッジを追加することです。

索引モデルが issue の本文から書いたものです。