requirements: set lower bound for requests

1.2.1 includes url-encoding headers, which we rely on.

Signed-off-by: Josh Durgin <josh.durgin@inktank.com>