PEP 708 implementation

[sepehr-rs]

This PR continues the implementation effort for PEP 708, building on the work in #12813.
Since the original PR is now inactive, I have rebased the branch onto the current main, and I am working to complete the implementation so pip can make use of metadata already supported by PyPI.

[sepehr-rs]

Hi @notatallshaw, sorry to bother you about this.
The code is functional and mostly stabilized now (though there’s still plenty of work left), but two tests are currently failing:

FAILED tests/functional/test_install_config.py::test_command_line_append_flags - AssertionError: Script returned code: 1
FAILED tests/functional/test_install_config.py::test_command_line_appends_correctly - AssertionError: Script returned code: 1

These failures happen because the tests end up triggering check_multiple_remote_repositories. For example:

{'is_file': False, 'file_path': None, 'comes_from': 'https://test.pypi.org/simple/initools/', 'metadata_urls': {'https://test.pypi.org/simple/initools/'}}
{'https://test.pypi.org/simple/initools/'}
{'is_file': False, 'file_path': None, 'comes_from': 'https://pypi.org/simple/initools/', 'metadata_urls': {'https://pypi.org/simple/initools/'}}

Since there’s no Track or Alternate Location metadata indicating these repositories can be merged, this isn’t PEP 708 compliant, and check_multiple_remote_repositories raises UnsafeMultipleRemoteRepositories, which causes the tests to fail.

I see two possible approaches:

1. Update the tests so that they're PEP 708 compliant.
2. Add a set of trusted PyPI-family URLs to check_multiple_remote_repositories so that these cases are exempt from the safety check.

Before moving forward, I’d really appreciate your guidance on which direction makes the most sense. Thanks!