Support configurable index urls for pip and private registry auth (not just) for pip

[chmeliik]

TLDR:

• --index-url in requirements.txt is no longer ignored
• If the index url is anything other than https://pypi.org/simple/, report it in the SBOM
• Tell aiohttp not to ignore .netrc
• Add way to run local PyPI server that requires auth, add integration test that uses it

Run new test with:

make test-integration TEST_LOCAL_PYPISERVER=true TOX_ARGS='-k custom_index'

Maintainers will complete the following section

• [x] Commit messages are descriptive enough
• [x] Code coverage from testing does not decrease and new code is covered
• [x] Docs updated (if applicable)
• [ ] Docs links in the code are still valid (if docs were updated)

Note: if the contribution is external (not from an organization member), the CI pipeline will not run automatically. After verifying that the CI is safe to run:

• approve GitHub Actions workflows by clicking a button
• approve the Red Hat Trusted App Pipeline container build by commenting /ok-to-test (as is the standard for Pipelines as Code)

[chmeliik]

This should be everything that's needed for cachi2 to support custom PyPI servers, including auth.

Auth is done via .netrc, same as pip: https://pip.pypa.io/en/stable/topics/authentication/#netrc-support. Pip also supports keyring auth but the docs make it sound rather strange. Doesn't seem worth supporting.

Let me know if you would like an ADR for any of this :saluting_face:

TODO: make the integration test run in CI, ideally without copy-pasting most of the Makefile target

[taylormadore]

Wow, this did indeed end up being quite straightforward. LGTM so far :+1:

[chmeliik]

I've made the CI work with the new int. test, should be ready for review

[chmeliik]

One more small improvement: used contextlib.ExitStack to make absolutely sure the process get .terminate()-ed before python starts waiting for it to clean it up

[chmeliik]

Just a rebase, will address comments in next force-push