Verify PEP 658 sidecar metadata with the downloaded wheel (#13991)

The PEP requires that the metadata is identical, and while it
doesn't mandate that consumers confirm this, it's good to check
anyway as it could lead to some very confusing behaviour otherwise.

This is explicitly outside of pip's threat model since it assumes
a malicious (or buggy) index. 

Co-authored-by: Richard Si <sichard26@gmail.com>
Co-authored-by: Damian Shaw <damian.peter.shaw@gmail.com>