Remove direct support for PEP381 Mirrors

* PEP381 Mirroring support was never fully implemented leaving
  users of it trivially exploitable to a MITM or malicious mirror
  operator.
* 2 out of 6 of the mirrors have been removed from the pool and
  will never resolve.
* The remaining mirrors often fall behind
* The mirrors will likely never be available under HTTPS
* People who wish to use a mirror of PyPI can still do so by
  manually specifying a mirror url for --index-url or
  --extra-index-url which is more flexible, allowing for
  mirrors to be hosted under any domain.
Restore some functionality to --mirrors and issue a warning
Merge pull request #1098 from dstufft/remove-mirror-support

Remove direct support for PEP381 Mirrors
Fix upgrade examples in cookbook
Merge pull request #1108 from dpursehouse/fix-upgrade-examples

Fix upgrade examples in cookbook
Vendor colorama
Render logging output with colors if they are supported
Emit Log.error with a log level of ERROR
Add Log.deprecated which takes a removal version and logs a message

Deprecation message will use Log.warn if removal version is > 1
release away, otherwise it will use log.error
Use the new Log.deprecated to log the messages about mirrors
Split the version parsing into it's own function
Pass the environ dict into should_color
Add some tests to ensure behavior
Fix on Windows
let --download work with wheels
switch test to working mirror
Merge pull request #1113 from qwcode/fix_1106

let --download work with wheels
fix up the bundle support
Add CVE identifiers for some of the security issues
Document the PR