Implement --fix for PipSource

[di]

For each of the available inputs, support adding a --fix flag which will automatically update the dependency specification or environment in question to exclude any found vulnerabilities.

For example:

• if a vulnerability is found in a local environment, uninstall it and install a version with the fix
• if a vulnerability is found in a requirements.txt file, update the version specification for the affected project to exclude the vulnerable version

This should be a meta-issue for determining the UX around this feature, and we should create sub-issues for each of the potential ways a fix can be applied.

• pip, _fix: Implement --fix for PipSource #212
• Show vulnerabilities removed via --fix in JSON and columnar formats #215

[woodruffw]

An idle thought around the UX: anything that involves fixes should also support a --dry-run mode, where we tell the user what actions we'd take (e.g. updating a dep in their environment, rewriting their requirements.txt).

[tetsuo-cpp]

I've opened #214 and #215 to track the remainder of this work. I'm going to repurpose this ticket to only capture the work for implementing --fix for PipSource.