While build requirements are indeed not stored in the final RPM (as jsbillings pointed out) dnf was improved over the last years so you can actually query build requirements now.
dnf repoquery --disablerepo=* --enablerepo=*-source --arch=src --whatrequires <provide>
Source: Examples in the DNF Command Reference (at the very end of that section)
I'm getting the following message
Package code-1.40.1-1573664332.el7.x86_64.rpm is not signed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED
So the code package isn't signed.
Let's see which repo provides it:
dnf provides code | ...
One can see in the output that the package is signed with GPG key 0x3C3359C4. Looking at the list of Fedora keys, one finds that this is the signing key for Fedora 32. But looking at /etc/yum.repos.d/fedora-rawhide.repo one can see that it uses $releasever to resolve the key. On my system that is the key for Fedora 31 and therefore it does not work. I have ...