`pip` sometimes includes debug messages on `stdout`

This is an abbreviated copy of #115 and #116, since those have been filled up with additional debugging.



Summary: In rare cases (currently N=1), we fail to collect environmental dependencies from `PipSource`. `PipSource` uses `pip-api` internally, which boils down to `pip list --format=json`. 



What *seems* to happen is that the `pip list --format=json` command doesn't emit *just* JSON. Instead, it *also* emits a trailing log message that looks like this:



```

Given no hashes to check 181 links for project 'pip': discarding no candidates

```



According to `pip`'s source code, that message is produced by a call to `log.debug`, which **should** be going to `stderr` instead of `stdout`. `pip-api` only uses `stdout` from `pip` subprocesses, so this is a strong indicator that the two streams are being mixed and/or confused somewhere, potentially with a logging override. The original reporter also traced the process and confirmed that the log was produced on `stdout`.



The original reporter found this on Python 3.9, `pip` version `20.3.3`. I was unable to reproduce it locally, and they were also unable to reliably reproduce it locally. 

[]