Stabilize PyPI source spec

- avoid live `pypi.org` lookups in `cmd/source` specs so the
  regression is deterministic
- keep coverage on `pypi_repo_url` package parsing by asserting the
  expected JSON API request