Subset lockfile as a separately cacheable process before building any PEX

[huonw]

Currently just experimenting.

Intention is to make the input digests to PEX builds more precise.

Fixes #15694

[huonw]

Limitations:

• currently pex3 lock export-subset seems to only export for specific platforms (current one by default, I imagine), which seems annoyingly finnicky: can I convince it to just export everything it knows about? It's "just" text manipulation, I believe? Potentially loses information, i.e. we'll be saying "install this library" if it's a potential dependency that's not relevant to the platform in question.
• I don't think a requirements.txt file can support both PyPI requirements with --hash and VCS requirements, e.g.

pytest @ git+https://github.com/pytest-dev/pytest@8.2.2
numpy==1.26.4 \
  --hash=sha256:52b8b60467cd7dd1e9ed082188b4e6bb35aa5cdd01777621a1658910745b90be

Collecting pytest@ git+https://github.com/pytest-dev/pytest@8.2.2 (from -r requirements.txt (line 1))
ERROR: Can't verify hashes for these requirements because we don't have a way to hash version control repositories:
    pytest@ git+https://github.com/pytest-dev/pytest@8.2.2 from git+https://github.com/pytest-dev/pytest@8.2.2 (from -r requirements.txt (line 1))

So. iteration required.

[huonw]

Closing for now, definitely needs pex-tool/pex#2411