Environmental audits: run pip list in the local virtual environment, if present

[woodruffw]

This is a follow-on to #450.

#451 "resolves" the issue by emitting a warning on the current ambiguity, but we can do better than that: instead of just warning, we can use ${VIRTUAL_ENV}/bin/python as pip_api's Python base, which in turn will allow globally installed copies of pip-audit to audit local virtual environments (as users might intuitively expect).

To do that, we'll need to re-think how we use pip_api, and possibly upstream some changes:

• We can't rely on pip_api.PIP_VERSION, since it's computed eagerly from whatever pip was found at module import time. Maybe we should just use pip_api.version().
• It might make sense to change how pip_api currently supports overrides -- PIPAPI_PYTHON_LOCATION in the environment could probably be replaced with something more ergonomic.