Implement a --verify-hashes hash-checking mode

[charliermarsh]

Summary

This is an alternative to --require-hashes which will validate a hash if it's present, but ignore requirements that omit hashes or are absent from the lockfile entirely.

So, e.g., transitive dependencies that are missing will not error; nor will dependencies that are included but lack a hash.

Closes #3305.

[charliermarsh]

@helderco -- what do you think of this behavior? I'm wondering if we should instead implement it such that if any hash is present, we enforce hashes (i.e., a setting that enables pip's default "implied hashes" behavior).

[helderco]

Yeah, requiring all hashes if any are present sgtm!

[charliermarsh]

Moving forward with this since we need it as the default for the lockfile.