add --allow-external and process requirements.local last

[miraculixx]

• without --allow-external, --process-dependency-links wouldn't find github-hosted packages
• if requirements.local is processed first there can be conflicts in overriding or providing a dependency in requirements.extra *)
• deduplicate the code around installing requirements.local or requirements.local.$APP

*) Rationale: e.g. a package in requirements.local requests "abc>=1.0.3" and fetches abc==2.0, however requirements.extra specifies abc==1.2, at the time requirements.extra is processed it would ignore abc==1.2. a similar case ensues when requirements.local requests a package that itself does not know to fetch in the particular version it requests, e.g. because the dependency link is wrong, where however a requirements.extra installation is provided

[miraculixx]

@gaumire please review - any red flags with these changes? thx.

[gaumire]

looks good, hoping you've tested it.

[gaumire]

@miraculixx would like to request to also remove these lines in this PR. Duplication.