_dependency_source/pip: Log a warning and skip auditing for packages with invalid versions

[tetsuo-cpp]

Closes #138

[di]

Would it make sense to list dependencies that can't be audited in the summary / JSON output as well?

I also think this would be something users might want to influence whether the audit passes or fails. Perhaps we want a --strict mode that makes the presence of an unauditable dependency a failure?

[di]

(Doesn't have to happen in this PR, just thinking about what we should do with unauditable dependencies long-term)

[tetsuo-cpp]

@di
I like these ideas. I've created #141 and #142 to track them.

[woodruffw]

LGTM, thanks!