Differentiate between internal and external links where possible

* By default ignore external links
* Add the ``--allow-external`` flag that enables external links
  globally
* Fallback to allowing all links if we cannot determine the
  API version of the parsed page
* Inform the user of ``--allow-external`` if nothing was found
  to install
In accordance with PEP438 default to allowing external urls

* After one release has been made allowing external urls, future
  releases will disallow by default
Differentiate between safe and unsafe urls where possible

* Links and HTMLPages know if they are "trusted"
* File Links know if they are safe or not
* A "Safe" file Link comes from a trusted Link/HTMLPage and has
  a hash allowing verification of the download
* Adds a --allow-unsafe PACKAGE argument to allow unsafe files on
  a per package basis
* Optimizes scraping external sites by short circuiting if
  the current trust rules won't allow using it's files anyways
Default to allowing unsafe urls and allow disabling them via option
Change wording from "unsafe" to "insecure"
Test the different variations of allow_insecure and allow_external
Change --allow-external to work per project and add --allow-all-external
Document the logic behind Externally Hosted Files
Enable --no-allow-insecure inside of a requirements.txt
Merge pull request #985 from pypa/ignore-external-and-unsafe-urls

Ignore external and unsafe urls aka PEP438