Grab rhubarb package on PyPI (prod)

[Elkasitu]

The rhubarb project on PyPI was available on the dev environment of PyPI but not on the production environment.

Due to this, currently rhubarb is being pulled from GitHub directly into downstream dependencies (such as OSIDB), which can be less stable and secure as it cannot be cached by internal PyPI mirrors.

The PyPI maintainers are close to releasing the project name for future use.

This means that Product Security could finally own the project and publish it to PyPI.

P.S. I currently own the project in the PyPI test instance but can relinquish ownership to ProdSec if requested

cc @JakubFrejlach @osoukup

[osoukup]

Sounds like something for 2025 🤔 I am going to create a tracking work item on our side.