feature(bootstrap): add -e/-PipRequirements to install PyPI packagesbefore Salt starts

[twangboy]

What does this PR do?

Add a requirements-file option to bootstrap-salt.sh (-e FILE) and bootstrap-salt.ps1 (-PipRequirements FILE) that installs PyPI packages, such as Salt Extensions, into the Salt onedir with salt-pip after Salt is installed and before its services are first started. Pinning and custom or authenticated indexes use normal pip syntax in the file (==, --index-url, --extra-index-url, PIP_INDEX_URL), so no credentials are needed on the command line. The file's contents are never printed.

Linux:

• Onedir installs only. -e is rejected up front for git installs, -C, macOS, and a missing or package-less file.
• Debian and Ubuntu packages start the service as soon as they are installed, even with -X. When -e is used, a temporary policy-rc.d holds back service starts until the packages are installed. Any existing policy-rc.d is restored afterward, including on failure and signals, via the existing exit trap.
• RPM based and other onedir installs only enable the services, so they need no guard.

Windows:

• salt-pip.exe runs between the installer finishing (already run with /start-service=0) and the service start. The path is resolved before the elevation relaunch so a relative path still works. Hardening, since the file is installed as root/administrator:
• salt-pip runs from / (Linux) or %SystemRoot% (Windows), not from the requirements file's directory. "python -m pip" puts the working directory first on sys.path, so running from a directory others can write to would let them run code as root. Local package paths in the file must therefore be absolute; nested -r files still resolve against the file.
• salt-pip is only used from its fixed locations (/usr/bin/salt-pip, /opt/saltstack/salt/salt-pip), never found through PATH.
• The policy-rc.d path is a fixed default, not read from the environment.
• A world-writable requirements file is refused, and a group-writable one produces a warning.

macOS is not supported: the pkg postinstall starts the minion itself during installer -pkg, leaving no window to install packages first. Tests: ShellSpec specs for validation, the pip step, the working directory and PATH hardening, and the start guard; Pester tests for the new functions; CI steps on Linux, Windows and macOS.

What issues does this PR fix or reference?

Closes #1975