fix(sdk): Kfp support for pip trusted host

[diegolovison]

Description of your changes:
In an airgap environment, a network is isolated from external connections, including the Internet, for security reasons. The administrator can provide a custom certificate that was created and managed internally to secure communication within the isolated network. The change on this PR, allows the user to trust a custom host where the user explicitly allows performing "insecure" SSL connections and transfers.

The pip_trusted_hosts is a string, in this case, the user can provide the host or host:port. This matches the pip command line argument.
If you type: pip install --help you will see the following output

--trusted-host <hostname>   Mark this host or host:port pair as trusted, even though it does not have valid or any HTTPS.

The new code introduces a way to avoid a breaking change but allows the user to not have any --trusted-host by adding pip_trusted_hosts=[]

Backward compatibility:
The changes in this PR ensure backward compatibility. The only difference will be the order for the pip call.
Before the change: --index-url https://pypi.org/simple --trusted-host https://pypi.org/simple --extra-index-url https://example.com/pypi/simple
After the change: --index-url https://pypi.org/simple --extra-index-url https://example.com/pypi/simple --trusted-host https://pypi.org/simple

The order has 0 side effects.

Real testing done in an airgap environment to ensure that this change is working

$ pip install kfp --index-url https://bastion-node:9443/root/pypi/+simple/
Looking in indexes: https://bastion-node:9443/root/pypi/+simple/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1133)'))': /root/pypi/+simple/kfp/
Could not fetch URL https://bastion-node:9443/root/pypi/+simple/kfp/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='bastion-node', port=9443): Max retries exceeded with url: /root/pypi/+simple/kfp/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1133)'))) - skipping
ERROR: Could not find a version that satisfies the requirement kfp (from versions: none)

$ pip install kfp --index-url https://bastion-node:9443/root/pypi/+simple/ --trusted-host bastion-node
Looking in indexes: https://bastion-node:9443/root/pypi/+simple/
Collecting kfp
  Downloading https://bastion-node:9443/root/pypi/%2Bf/06a/d584eecbe8031/kfp-2.8.0.tar.gz (594 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 594.4/594.4 kB 2.3 MB/s eta 0:00:00
  Preparing metadata (setup.py) ... done
Collecting click<9,>=8.0.0 (from kfp)
  Downloading https://bastion-node:9443/root/pypi/%2Bf/ae7/4fb96c20a0277/click-8.1.7-py3-none-any.whl (97 kB)
Collecting docstring-parser<1,>=0.7.3 (from kfp)

Checklist:

• [ X ] The title for your pull request (PR) should follow our title convention. Learn more about the pull request title convention used in this repository.

[google-oss-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[jstourac]

I have absolutely zero knowledge about this code-base here, but I reviewed this based on this comment. I put one comment, which is irrelevant probably, otherwise LGTM.

[HumairAK]

small nit, otherwise lgtm

@diegolovison I think it's worth creating an issue requiring that the secure path should be the default, and possibly bringing it up next kfp call

[HumairAK]

/lgtm

[HumairAK]

/lgtm

[HumairAK]

@chensun can you please take a look, (also see discussion here)

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chensun

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• sdk/OWNERS [chensun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chensun]

/retest-required