Refactor -r pylock.toml

Insstead of adding a locked_link and locked_version to
InstallRequirement, provide a locked link per project name to the
PackageFinder.

Let get_all_candidate ignore indexes and --find-link when a locked link
is known for a project.

This naturally supports format control, so the duplicate implementation
 in constructors.py can be removed. This also naturally supports release
control, as well as --uploaded-prior-to (via the upload_time field of
pylock.toml).

All in all, this is a much simpler and natural implementation.