Treat HTTP and invalid HTTPS the same

Instead of making a global ``--no-check-certificate`` option which allows allowing all invalid TLS, we'll treat invalid HTTPS similar to how we're going to treat HTTP in general: disallowed unless opt-in on a per host basis.

In particular:

* Drop the global ``--no-check-certificate`` in favor of using ``--trusted-host``on a hostname by hostname basis.
* Filter the warnings from urllib3 so that invalid HTTPS doesn't warn if we have a ``--trusted-host``.
* Only support caching on valid HTTPS requests because we don't want a single invocation of pip with a ``--trusted-host`` flag to be able to have a forever poisoned cache.

With the expanded responsibility of the ``--trusted-host`` flag, I'm not entirely sure I like the name still but I can't come up with anything better.

Fixes #2190