Bump distlib to `master`. Wild, right?

I know, but we really need the newest `AggregatingLocator._get_project()`. This
new guy tries to match all the versions found with the version actually required
and return the first one that matches;