Add support for URL requirements in --generate-hashes

[charliermarsh]

Summary

This PR enables hash generation for URL requirements when the user provides --generate-hashes to pip compile. While we include the hashes from the registry already, today, we omit hashes for URLs.

To power hash generation, we introduce a HashPolicy abstraction:

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum HashPolicy<'a> {
    /// No hash policy is specified.
    None,
    /// Hashes should be generated (specifically, a SHA-256 hash), but not validated.
    Generate,
    /// Hashes should be validated against a pre-defined list of hashes. If necessary, hashes should
    /// be generated so as to ensure that the archive is valid.
    Validate(&'a [HashDigest]),
}

All of the methods on the distribution database now accept this policy, instead of accepting &'a [HashDigest].

Closes #2378.

[charliermarsh]

Worst part of this PR but not 100% sure how to solve. It's fine in practice, just somewhat brittle.