Implement PEP438

* Warn for external urls if they are verified but install them
  by default
* Disallow unsafe urls and if this prevents installation provide
  help text to instruct how to bypass
* Add a --no-allow-external that disables verifiable external
  urls and if this prevents installation provide help text to
  instruct how to bypass
* Add a --allow-external which in the future will provide help
  to bypass a skipped external url