Component detection for pip does not read constraints.txt file

Component detector for pip ignores constraints.txt file (https://pip.pypa.io/en/stable/user_guide/#constraints-files) and finds new versions for dependent Python packages even when their versions are fixed in the constraints file.

Start at the pip component detector and review the pip constraints-file documentation linked in the issue. Trace how dependency versions are currently discovered and determine how constraints.txt should affect that process. Done means packages constrained by constraints.txt are reported at their fixed versions rather than newer versions.

Written by the indexing model from the issue text.