reject file:// urls in pylock packages fetched from a URL

[Arawoof06]

What does this PR do?

When a pylock.toml is fetched from an http(s) URL, _package_dist_url returns a package's url field unchanged, so an entry with url = "file:///etc/passwd" (or file://host/share/pkg.whl on Windows) makes pip read a local file or reach an SMB share even though the lock came from a remote server. #14159 closed this for the relative path field, and package_directory_requirement_url already refuses local targets for directory entries; this applies the same rule to the url field used by wheel/sdist/archive/vcs packages, while still letting a remote lock reference other http(s) hosts.

PR Checklist:

• I agree to follow the PSF Code of Conduct.
• I have read and have followed the CONTRIBUTING.md file.
• I have added a news file fragment (or this PR does not need one).
• I have read and followed the AI_POLICY.md file, and if any AI tools were used, I have disclosed it below.

[ichard26]

Like with all of the other PRs, I still take issue with the comments. Keep them brief, please. Also, this is not a security vulnerability as we assume that pip is being handed trusted input. Otherwise, I'll leave this for review by @sbidoul.

[Arawoof06]

Trimmed the comment down to a single line. And noted on the threat model - I'll drop the security framing; the behaviour change still seems worth having for consistency with the path branch and the directory-entry check. Happy to let sbidoul take it from here.