Update to latest pip

[josephlbarnett]

Also allow GIT_OAUTH_KEY environment variable to be passed through to pip.

---

We wanted to be able to remove github oauth key values from our requirements.txt files that are checked into source control. With later versions of pip (10+), it can read them from an environment variables. This PR updates to the current latest pip (18.1), fixing #740, and allows passthrough of a GIT_OAUTH_KEY env variable from heroku in order to meet this use case.

[CaseyFaist]

Hi @josephlbarnett ! Thanks for the PR. I have some context and questions for you:

• Currently, pip version 9 is set for both pip install and pipenv install flows. The Pipenv version currently locked in the buildpack does not work with modern pip (this was surfaced in a buildpack bug back in October). Updating Pip is necessary, but this update as-is would require significant communication with current pipenv users to avoid breaking changes.

• Continuing to add sourced env vars is not the ideal pattern moving forward for the buildpack, although it has been necessary for blocking issues. Did you explore the private auth flow discussed in [Feature reqeust] Let python buildpack can access private repo with custom environment variables #776 ? What worked for you and what didn't?

[josephlbarnett]

Thanks for the reply Casey, we hadn't looked at #776, will do so now.