feat(pypi): support direct urls for wheels in bazel downloader

[chrisirhc]

This PR adds support for installing wheels via direct urls in the requirements lock file:

foo==0.0.1 @ https://someurl.org/package.whl
bar==0.0.1 @ https://someurl.org/package.tar.gz

This is to improve parity between bazel downloader and pip behavior.
Before this change, direct urls used fallback to pip install.

Partially addresses #2363 as it does not add support for git urls.

[aignas]

Thank you for the contribution.

My guess is that direct urls can return sdists via checking the filename for the extensions listed in here. If I can get confirmation on this, I can update this PR to add sdist support for direct urls or leave that as a separate PR.

I think this part might be good to leave for another PR.

[aignas]

LGTM in general, I think we can correctly infer the sdist vs not via the direct URLs, so I think its fine to just do it.

Could you please also add the CHANGELOG note about the added support.

[aignas]

Thank you so much!