Default to disallowing external and insecurely hosted files

This changes the default from allowing and only warning on externally or insecurely hosted files to disallowing. It leaves the existing options that allowed people to opt into the new behavior there but suppresses their output in help and no longer uses their value.

Whenever pip installs an external or insecurely hosted file it will display a warning about why someone might want to not do that.