{Packaging} Loosen cryptography dependency

[jiasli]

Description

• Fix Unpin cryptography package in azure-cli-core #19635

Reasons why we can loose the cryptography dependency now:

For upper bound

#15687 (comment) set an upper bound for cryptography due to pyca/cryptography#5771.

By following https://cryptography.io/en/latest/installation/#alpine, I am now able to install cryptography 3.4.8 on Alpine Linux (#19591). There is no need to set upper bound now.

For lower bound

Community packagers ask us not to bump the minimum dependency in setup.py as this causes trouble for platforms that doesn't support newer versions of cryptography (#15687 (comment)). By loosing the dependency on cryptography, users or packagers themselves are now responsible for security vulnerabilities in older versions of cryptography.

As we still pin the version in requirements.*.txt, packages distributed by us still contain cryptography which is security-complaint.

[yonzhan]

Packaging

[jiasli]

@glaubitz, I have totally removed the lower bound. Will this suit your need?

[glaubitz]

Is version 3.0 actually the absolute minimum that you need now? That is, is there functionality that you need that is not part of version 2.8?

[jiasli]

We don't require >3.0 now. Any version works.

[glaubitz]

Then either remove the version requirement or use at least 2.8 which is what SLE-12 and SLE-15 are shipping at the moment.

[jiasli]

Then either remove the version requirement

It is already removed.

https://github.com/Azure/azure-cli/pull/19639/files