Lint: Add Check for pip install

[jspeed-meyers]

pip install should not be used in melange YAML files when building Python packages for Wolfi. Why? Because APKs for Python in Wolfi are meant to contain one and only one Python package. Using pip install in a Python package adds more than one Python package to an APK. Why only one Python package per APK package? This, to my knowledge, is to make a "better" SBOM (more complete) and to make vulnerability remediation easier.

Unfortunately:

➜  os git:(main) date
Wed Oct  4 05:16:53 EDT 2023
➜  os git:(main) git rev-parse --short HEAD   
6f138fe7
➜  os git:(main) pwd
~/Desktop/repos/public/os
➜  os git:(main) grep -r "pip install" | wc -l
      39

There are at least 39 instances currently of pip install across Wolfi packages. After these are fixed, I propose adding a lint to detect usage of pip install in a melange YAML file. It would be fine to add it earlier too, as long as there is a way to disable that particular check during CI (until these instances of pip install are removed).

cc @luhring @kaniini

h/t @luhring -- This is really just reporting his finding!

ref
wolfi-dev/os#6244

[Elizafox]

I'm adding a check for this in chainguard-dev/melange#764