Drop django-tagging as dependency

[fopina]

django-DefectDojo/requirements.txt

Line 21 in 228d0d5

git+https://github.com/DefectDojo/django-tagging@develop#egg=django-tagging

Can some custom migration or check be added to cover cases of people that still need this (old version), pointing them towards a middle-step upgrade first?

In some CIs internet access is limited and there are internal proxies to popular package managers (such as pypi), flagging/failing git+http dependencies.

I'm not familiar with the reason why this is kept: based on comment I can only assume that django-tagging was replaced with tagulous and some migration is moving the data.
If that's the case, that migration could be updated to just throw an exception (keeping the same name) directing owner to a previous version before running that one (if there is any data to migrate, to cover for new setups).

I'm happy to push a PR if that's the case, so it can be considered. Or to push a PR on the django-tagging fork to publish it to pypi under some "forked" package name, if that's preferred (though cleanup would sound better to me)

[valentijnscholten]

This is on our radar and could be something we do for v3. If we want to do it sooner we could:

• add to the upgrade notes of v2.0.0. that users need to upgrade to v1.11.0 first to make sure tags are migrated already
• remove the data migration logic and requirements entry in the next monthly release.

Let me check with the team first before you make a PR.

[valentijnscholten]

@fopina We would welcome a PR for this 👍

[fopina]

Tried to come up with some strict testing but it's impossible to install Dojo v1.10 at this point - too many dependency issues...
I've created #13216 - let me know what you think!