Add mechanism to pin/exclude packages from upgrade

[pnasrat]

As per @carljm suggestion in issue #650 we should add a feature to support pinning/blacklisting/excluding packages from upgrade, including handling if it's pulled in as a dep.

[dstufft]

Closing this. While the underlying cause is still there it will be lessened by the work to move pip away from an eager upgrade strategy. In addition it can be better solved by using pip-compile or by mentioning the pinned dependency at the command line (e.g. pip install thing-to-install thing-to-pin==1.0 -U.