Implement provenance records for installed packages (PEP 710)

[sethmlarson]

Is your feature/enhancement proposal related to a problem? Please describe.

My request is to implement recording provenance information (PEP 710 draft) for packages installed from an index into the environment. This record is useful for generating artifacts out of an existing Python environment, such as creating a lock file or Software Bill-of-Materials document from installed packages.

You can join the discussion on the PEP 710 proposal here.

There is already an existing pull request for pip (that will be rebased soon).

Describe the solution you'd like

PEP 710 is an "extension" of PEP 610, which PDM already supports. For packages that are installed not using PEP 610 a similar file (provenance_url.json) will be recorded into the dist-info in the environment with information about the download URL, hashes, and index.

cc @fridex