Refactor checking of hashes embedded in user-provided URLs

[sbidoul]

Some URLs can contain hashes, like so: https://example.com/archive-1.0.tar.gz#sha256=abcdef...
Such URLs can be provided by the user, in which case the hash must be considered good, and the dowloaded resource verified against that hash.
Such URLs can also be obtained from indexes, in which case the hash must be verified, but not trusted.

The hashes() method of InstallRequirements is extremely sensitive to whether original_link is set or not.
It is also very hard (to me) to understand when and why trust_internet must be True or False.
While working on #11897 I found that it was very easy to break hash checking just by trying to preserve req.original_link after obtaining a cache entry.

So I propose this refactoring that achieves the same behaviour in a more robust way, by extending hash_options with the hash passed in the link URL when we are certain that such a link is user provided.

Creating as draft to check tests pass and I'm still sane of mind... Not ready to review.