Add pip check after final install

[nitzmahone]

The pip depsolver currently only issues warnings when an incompatible version of a package is installed (eg, when a later install with a conflicting dep breaks a previous one)- someone looking carefully at their container build output might see the warning text that an incompatible dep was installed, but there's no way to make that an error today.

Adding a pip check at the end of the build (available in some form since ~pip 9) will, for more modern versions of pip, re-do the dep check for all installed packages and issue an error listing the broken deps (which would fail the build). We'll probably also need EE definition syntax to disable/ignore the results of this check, but surfacing the problem by default is probably the right thing to do. Suspect we'll find a lot more busted collection deps this way, for better or worse.

[ssbarnea]

That is a very good idea, I being adding pip check even inside our tox commands for catching problems for year and it did help. One of the most useful one-linters.