Safer usage requests sessions and account for the verify_ssl requirements of each source.

[matteius]

Thank you for contributing to Pipenv!

The issue

Fixes #5724

The fix

The improvement to the pep 508 URLs for determining appropriate hash did not consider the verify_ssl requirements. Also, it seemed odd to me that even though pipenv is multi-processing we had a global variable for the requests session state. This made it hard to have different requests (some that verify ssl and some that do not). Since the primary point of re-use of the requests session is in the Resolver, I made a patch there to have a separate requests session per source.

The checklist

• Associated issue
• A news fragment in the news/ directory to describe this fix with the extension .bugfix.rst, .feature.rst, .behavior.rst, .doc.rst. .vendor.rst. or .trivial.rst (this will appear in the release changelog). Use semantic line breaks and name the file after the issue number or the PR #.