Filter mixed sources from --find-links entries in lockfile

[charliermarsh]

Summary

Our current handling of --find-links merges the entries in each index. As a result, we can end up with AnnotatedDist entries that reference distributions across indexes.

I'd like to change --find-links such that each --find-links entry is just treated as its own index (so, e.g., if requests exists in the first --find-links entry, we don't even check the registry by default), which would also fix this problem automatically. But that's a behavior change... So for now, in the lockfile, we filter distributions that don't match the source index URL.

There are two cases to consider:

• There's a source distribution. Then, for the ID to reference the --find-links registry, the source distribution must have come from the --find-links entry, so it's fine to discard any wheels from the "wrong" registry without breaking any compatibility guarantees.
• There's no source distribution. Then the best wheel must come from the --find-links registry. We might lose some platform coverage by discarding the other wheels, but it shouldn't break any of the "guarantees", since we have at least one wheel that fits in the version range.

Closes #6015.

[BurntSushi]

Makes sense to me!