Consider implementing integrity checks of downloaded packages

[dmerejkowsky]

Idea:

Once the requirements.lock has been generated, run hashin -r requirements.lock with all packages names.

This is enough because pip install -r will see at least one hash and will turn on integrity checks automatically

[dmerejkowsky]

Some ideas:

• Also use --only-binary=:all: -> this means storing the wheel for packages that don't have them in a mirror maybe ?
• Since we'll need to change the requirements.lock parser, maybe give pest a try