Since virtualenv uses the built-in pip version with VIRTUALENV_DOWNLOAD=no we need to make sure we keep virtualenv capped, but we can use a newer pip.
This way we can update pip independently before installing the rest, and avoid installing codecov (and thus coverage which attempts to build C extension) where it's not needed.