resolve symlinks in local files

the tar libraries choke when checking valid
filenames because they don't resolve symlinks
Merge branch 'hotfix/1.0.2'
Merge pull request #245 from ptone/find-links-symlinks

resolve symlinks in local files
Merge branch 'release/1.1'
Merge branch 'release/1.2'
Merge branch 'release/1.2.1'
Merge branch '1.3.X'
Merge branch '1.3.X'
Fixed typo in some help messages
Merge pull request #955 from Zearin/master

Fixed typo in some help messages
Differentiate between internal and external links where possible

* By default ignore external links
* Add the ``--allow-external`` flag that enables external links
  globally
* Fallback to allowing all links if we cannot determine the
  API version of the parsed page
* Inform the user of ``--allow-external`` if nothing was found
  to install
In accordance with PEP438 default to allowing external urls

* After one release has been made allowing external urls, future
  releases will disallow by default
Differentiate between safe and unsafe urls where possible

* Links and HTMLPages know if they are "trusted"
* File Links know if they are safe or not
* A "Safe" file Link comes from a trusted Link/HTMLPage and has
  a hash allowing verification of the download
* Adds a --allow-unsafe PACKAGE argument to allow unsafe files on
  a per package basis
* Optimizes scraping external sites by short circuiting if
  the current trust rules won't allow using it's files anyways
Default to allowing unsafe urls and allow disabling them via option
Change wording from "unsafe" to "insecure"
Test the different variations of allow_insecure and allow_external
Change --allow-external to work per project and add --allow-all-external
Document the logic behind Externally Hosted Files
Enable --no-allow-insecure inside of a requirements.txt
Merge pull request #985 from pypa/ignore-external-and-unsafe-urls

Ignore external and unsafe urls aka PEP438