[Security] Ask for confirmation if "pip install pyproject.toml" or similar indicates wrong unsage

[MartinThoma]

What's the problem this feature will solve?
People sometimes execute commands like the following and are surprised of the behavior:

• pip install pyproject.toml
• pip install requirements.txt

This also has the potential to install malware as pyproject.toml and requirements-dev.txt. The requirements.txt cannot be registered and triggers "The name 'requirements.txt' isn't allowed. See https://pypi.org/help/#project-name for more information."

Describe the solution you'd like

1. User enters "pip install foobar"
2. pip checks if "foobar" is a file in the current directory
3. If it is, ask for confirmation if the project from pypi (given the link) should be installed or if the local file should be used (abort)