Add additional wheel validation checks

[pradyunsg]

I [@pfmoore] propose the following checks:

1. That the wheel has a METADATA file conforming to the PEP 314 spec. RFC822 format, with a subset of the mandatory keys present - Metadata-Version, Name, Version, Summary, Author-Email, License.
2. That the wheel has a RECORD file with lines for METADATA, WHEEL and RECORD. I'd like to think that checking hashes is overkill. However, the page linked in the issue report seems to be recommending deliberately omitting required aspects of the spec if you can get away with it, so I'm forced to consider that checking a couple of hashes (METADATA and WHEEL) might be sufficient to make omitting hashes too hard to be worth bothering about.
3. That all files in the wheel are mentioned in RECORD.

These checks are not comprehensive - the idea is to ensure people aren't uploading corrupt wheels, not to act as a full validation suite.

I'm honestly saddened that we need to do this. Deliberate violation of the wheel spec seems like the sort of bevaviour that should be fixable simply by letting the author of the invalid wheel know of their mistake. Having to defend against deliberate attempts to undermine the standardisation work going on is depressing.

Originally posted by @pfmoore in #3513 (comment)

Creating a follow up issue, to be able to track actually doing this. :)

[xavfernandez]

Somewhat related to #7179

[dholth]

bdist_wheel's unpacker, which is not used in pip, originally checked all hashes automatically as each file was extracted. (try the wheel unpack command on an invalid file)