Reuse/copy pip code for VCS and download

pip is a good starting point as https://github.com/pypa/pip/blob/master/src/pip/_internal/download.py is a solid and reliable download utility tested with billions of downloads.

There are a few ways to handle this:
1. use https://github.com/sarugaku/pip-shims and reuse pip code
2. copy and fork pip code
3. vendor pip code

Note pip also handles VCS URLs
See https://github.com/pypa/pip/tree/master/src/pip/_internal/vcs
The download location specified in SPDX is mostly derived from the pip URLs https://github.com/spdx/spdx-spec/blob/db06dc81e525e08035af34117127742337e1f1b6/chapters/3-package-information.md#37-package-download-location-

pip does not handle ftp AFAIK