Support filtering "system" dependencies

pip_api.installed_distributions() returns every visible distribution, which can potentially include distributions provided by the system/system package manager.

Issuing messages for these might not be desirable default behavior, for a few reasons:

• System-installed dependencies might be required by the system, and thus cannot be safely upgraded
• System-installed dependencies might be installed via a mechanism other than pip, so issued guidance might not always be applicable.
• System-installed dependencies might be patched by distribution maintainers to remove known vulnerabilities, without updating the version number.

As such, it probably makes sense for the CLI to have option(s) that allow the user to enable (or disable) filtering of dependencies that look like they’re supplied by the system. This, in turn, requires us to come up with a reliable way of determining whether a given dependency is a “system” one.

[woodruffw]

So I’d need to make a change to expose this functionality in pip-api.

Opened upstream tracking: https://github.com/di/pip-api/issues/101

[tetsuo-cpp]

Since this is going to involve manipulating virtual environments, it might be best to do #50 first.