Rename pip.vendor.* to pip._vendor.* to ensure it's obviously private

A few people have mentioned using pip.vendor.requests as a "bundled" version of requests, ensure they feel bad about using it by adding a _ to the vendor directory name.