drop deprecated `hash` in favor of `hashes`
* https://packaging.python.org/en/latest/specifications/direct-url/ supersedes PEP 610
* keeping `hash` for compatibility probably does not make sense since it was not spec-compliant (":" instead of "=" as separator between algorithm and value)