Add comment explaining public status to the module itself

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Author: jku

tuf/ngclient/_internal/requests_fetcher.py

@@ -5,6 +5,10 @@
   HTTP library.
 """
 
+# requests_fetcher is public but comes from _internal for now (because
+# sigstore-python 1.0 still uses the module from there). requests_fetcher
+# can be moved out of _internal once sigstore-python 1.0 is not relevant.
+
 import logging
 from typing import Dict, Iterator, Tuple
 from urllib import parse