read_configuration() reports wrong version if different version of package has already been imported

Consider a minimal Python project that uses the attr: directive to set its version, like so:

mymodule.py:

__version__ = "0.1.0"

setup.py:

from setuptools import setup
setup()

setup.cfg:

[metadata]
name = mymodule
version = attr:mymodule.__version__

[options]
py_modules = mymodule

If this project is installed in the current environment, and then the __version__ string in the source is changed to a new value, running the following (from a directory other than the one in which mymodule.py is located) will return the version of the installed project rather than the version in the source:

>>> import mymodule
>>> from setuptools.config import read_configuration
>>> read_configuration("path/to/setup.cfg")["metadata"]["version"]
'0.1.0'

This bug affects me because my package-releasing project makes use of read_configuration() while also depending on some of the same projects that it's used to manage & produce releases for, resulting in the wrong version being determined for those projects whenever I try to make a new release.

Start with the minimal project described in mymodule.py, setup.py, and setup.cfg, then reproduce the behavior through setuptools.config.read_configuration() after importing mymodule from the installed environment. Trace how the attr: version is resolved; done means read_configuration() returns the version from the specified source project rather than an already-imported installed package.