Rationale: it has happened multiple times in the recent past that users
needed to use a more recent Cython than was used to generate the sdist
of the most recent release available on PyPI (e.g. for building with
a not-yet-released version of Python for which a Cython fix just
landed). The dependency specification and packaging tools have matured
to the point where it should be fine to require Cython to be installed.
Also, we have wheels (and conda-forge packages) for Windows, Linux and
macOS, so this change won't be visible at all to the average user.
Closes gh-13790
Also adds pyproject.toml to MANIFEST.in, it was missing.