Thirdparty pip dependencies override root project's pip dependencies

# 🐞 bug report

### Affected Rule
```
use_extension("@rules_python//python/extensions:pip.bzl", "pip")
```

### Is this a regression?

Between old `WORKSPACE` rules and `bzlmod`, potentially yes - so long as you knew the order you were defining dependencies.

### Description
A third party project called foo uses `rules_python` and `bzlmod` to bring in pip dependencies:
```
pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
hub_name = "foo_pip_deps",
python_version = "3.11",
requirements_lock = "@foo//:requirements_lock.txt",
)
use_repo(pip, "foo_pip_deps")
```
This dependency is implicitly used as part of a library this third party defines. This `requirements_lock.txt` uses a pip module `matplotlib` at v1.
```
load("@foo_pip_deps//:requirements.bzl", "requirement")
py_library(
name = "foo",
srcs = ["foo.py"],
imports = ["."],
visibility = ["//visibility:public"],
deps = [requirement("matplotlib")], #v1
)
```
My root project uses the pip extension and its own `requirements_lock.txt` file to bring in `matplotlib` at v2.

If I depend on the `@foo` project:
```
load("@bar_pip_deps//:requirements.bzl", "requirement")
py_binary(
name = "main",
srcs = ["main.py"],
deps = [
"@foo",
requirement("matplotlib"), #v2
],
)
```
The target will now use `matplotlib` at v1. Even though my root project specifically asks for v2.

## 🔬 Minimal Reproduction

[Follow the examples in here](https://github.com/finn-ball/python_bzlmod_test)

## 🔥 Exception or Error

## 🌍 Your Environment

**Operating System:**

  

linux

  

**Output of `bazel version`:**

  

7.0.2

  

**Rules_python version:**

  

0.31.0

  

**Anything else relevant?**

首先使用链接的最小复现和所示的 pip 扩展配置来复现依赖解析行为。跟踪 root 和第三方 requirements_lock.txt 文件如何合并，然后验证当 root target 依赖 @foo 时，选择的是 root 项目的 matplotlib v2。当复现按描述解析出 root 依赖时，即表示完成。

由索引模型根据 Issue 内容生成。