download/extract automatic index freshening

[thatch]

Right now you have two choices for download/extract:

1. Don't pass --fresh, which will error out if we don't have a cached index with an sdist for that version
2. Pass --fresh, and always pay a roundtrip to update an index, even if the cached version has an sdist for that/

What we have now requires the caller to decide up front, and the api.download_* functions require you to already have a Package object. A stopgap would be a pick_sdist(pkg, ver) function that just has the list comprehension that keeps getting repeated:

sdists = [
    f for f in package.releases[version].files if f.file_type == FileType.SDIST
]