Use shell to pip to extract hashes

We currently rely on [`_hash_of_file`](https://github.com/peterbe/hashin/blob/77e2d93f40f7b48ea147f5b032e517cada70b96c/hashin.py#L366) to extract the checksum of a package using pip. Yuck! We should use a shell and call like this:
```python
subprocess.call(['python', '-m', 'pip', 'hash', ...])
```

Thanks @di for the tip!