PEP 668: Marking Python base environments as "externally managed"

In Debian’s case, we only use ensurepip to seed venvs with pip. For users who want pip, we direct them to install our separate pip package. So we don’t have an opinion on this issue, it doesn’t affect us.