WIP: Ignore external and unsafe urls

**This is a Work in Progress**

Ignores unsafe urls by default and warns for safe, but external urls by default.

Provides new flags to install

```
# Currently a no-op, will be used to allow external urls in the future
pip install --allow-external

# Disables external urls to opt into future behavior today
pip install --no-allow-external

# Allow an unsafe url which either comes from scrape target, or does not have a hash
pip install --allow-unsafe=FooPkg FooPkg
```

These still need to be implemented for the requirements.txt file and tests still need to be written. Lodging a WIP PR to get comments and run the full test suite on all Python versions to see if I broke any tests.