[BUG] pip.installed upgrade succeeds when index URL broken or unreachable

Description

When using a simple pip.installed state to upgrade an existing package, it will show as successful even if the the index URL is broken. A scenario where this might happen is an enterprise environment where access to public pypi is blocked, but configuration to an internal mirror/repository hasn't yet been configured.

Setup

• Install an old version of a package, e.g. colorama==0.4.3
• Simulate unreachable pypi. I added 127.0.0.1 pypi.org to my /etc/hosts

Steps to Reproduce the behavior

Run the following state:

upgrade-colorama:
  pip.installed:
    - name: colorama
    - upgrade: True

Output:

master1:
----------
          ID: upgrade-colorama
    Function: pip.installed
        Name: colorama
      Result: True
     Comment: All packages were successfully installed
     Started: 15:57:05.191723
    Duration: 16587.972 ms
     Changes:   

Summary for master1
------------
Succeeded: 1
Failed:    0
------------
Total states run:     1
Total run time:  16.588 s

Expected behavior

This should fail. There's an updated package out there. We didn't find it because the current index is unreachable. Unfortunately, pip isn't making it easy by exiting 0:

# pip3 install --upgrade colorama; echo $?
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7f8d82d68b70>: Failed to establish a new connection: [Errno 111] Connection refused',)': /simple/colorama/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7f8d82d68dd8>: Failed to establish a new connection: [Errno 111] Connection refused',)': /simple/colorama/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7f8d82d68d30>: Failed to establish a new connection: [Errno 111] Connection refused',)': /simple/colorama/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7f8d82d68f98>: Failed to establish a new connection: [Errno 111] Connection refused',)': /simple/colorama/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection object at 0x7f8d82d68518>: Failed to establish a new connection: [Errno 111] Connection refused',)': /simple/colorama/
Requirement already up-to-date: colorama in /usr/local/lib/python3.6/site-packages (0.4.3)
0

Versions Report

Salt Version:
           Salt: 3002
 
Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: Not Installed
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
         Jinja2: 2.11.1
        libgit2: Not Installed
       M2Crypto: 0.35.2
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.6.2
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: Not Installed
   pycryptodome: 3.9.8
         pygit2: Not Installed
         Python: 3.6.8 (default, Apr  2 2020, 13:34:55)
   python-gnupg: Not Installed
         PyYAML: 3.13
          PyZMQ: 17.0.0
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.1.4
 
System Versions:
           dist: centos 7 Core
         locale: UTF-8
        machine: x86_64
        release: 5.4.0-51-generic
         system: Linux
        version: CentOS Linux 7 Core

Start at the pip.installed state entry point and reproduce the shown upgrade-colorama state with pypi.org unreachable. Trace how pip's successful exit is interpreted, then add coverage for the unreachable-index case; done means the state reports failure rather than success when an upgrade check cannot reach its index.