Add option to restrict package dependency domains (supply chain attack)

[JPHutchins]

What's the problem this feature will solve?

Prevent local and upstream supply chain attacks that deliver compromised packages via a non-PyPI domain.

Describe the solution you'd like

Add a trusted-domains config option with reasonable defaults, like pypi.org, files.pythonhosted.org, etc.

Alternative Solutions

Users could setup firewall rules for pip to block corrupt dependency paths.

Additional context

170,000 Python users were impacted in this attack: https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/

I'm hopeful that we can mitigate such an attack!

Code of Conduct

• I agree to follow the PSF Code of Conduct.