Require a minimum version of setuptools (#322)

I was using `pex` on an application that lists `google-auth` as a dependency and got the following warning:

    ..../pex/environment.py:330 UserWarning: The `pkg_resources` package was loaded from a pex vendored version when declaring namespace packages defined by google-auth 1.6.2. The google-auth 1.6.2 distribution should fix its `install_requires` to include `setuptools`

So adding `setuptools` as a listed dependency to fix this.

Version `40.3.0` was chosen because it fixed a bug in the handling of
`pkg_resource`-style namespaces
(pypa/setuptools#1321). For more details on
why this version was picked, see the discussion in
#322.

Also making the listing alphabetical.

setup.py

@@ -19,10 +19,11 @@
 
 
 DEPENDENCIES = (
+    'cachetools>=2.0.0',
     'pyasn1-modules>=0.2.1',
     'rsa>=3.1.4',
+    'setuptools>=40.3.0',
     'six>=1.9.0',
-    'cachetools>=2.0.0',
 )