Remove xattr as hard dependency

[SimonBohnenQC]

xattr is not a hard dependency and should thus be removed.

Having xattr as a dependency leads to the following problem:

• xattr is not available on windows via conda-forge, see here
• quetz is a noarch package, see here
• the feedstock only builds using linux, so the problem isn't noticed there.
• but when building a new recipe, e.g. the one for the quetz-sql-authenticator, the build is also tested on Windows and fails, see here

[codecov-commenter]

Codecov Report

Base: 82.49% // Head: 81.61% // Decreases project coverage by -0.89% ⚠️

Coverage data is based on head (59591ab) compared to base (58d5362).
Patch coverage: 50.00% of modified lines in pull request are covered.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #602      +/-   ##
==========================================
- Coverage   82.49%   81.61%   -0.89%     
==========================================
  Files          78       78              
  Lines        6068     6070       +2     
==========================================
- Hits         5006     4954      -52     
- Misses       1062     1116      +54     

Impacted Files	Coverage Δ
quetz/pkgstores.py	42.48% <50.00%> (-11.57%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.