[fix] Use only ws.find in install

Replace `pkg_resources.Environment(ws.entries).best_match(req, ws)`
with `ws.find(req)`.

The first already starts by calling `ws.find(req)` to attempt to find
an already activated dist in the working set, but if none is found it
then proceeds to scan through the entries of the environment - i.e.
the locations of the directly-requested distributions, `ws.entries` -
to activate a dist at these locations if one matches.

This is problematic when directly-requested distributions are found in
a location shared by multiple dists, such as site-packages: this gives
that location precedence over the normal order of locations scanned by
easy_install, and can result in undesired versions being chosen over
versions available in ./eggs or in ./develop-eggs. The random aspect
of this is also problematic, as the order of paths considered will
depend on the order of the directly-requested distributions and where
they are found.

src/zc/buildout/easy_install.py

@@ -706,10 +706,6 @@ class Installer(object):
         requirements.reverse() # Set up the stack.
         processed = {}  # This is a set of processed requirements.
         best = {}  # This is a mapping of package name -> dist.
-        # Note that we don't use the existing environment, because we want
-        # to look for new eggs unless what we have is the best that
-        # matches the requirement.
-        env = pkg_resources.Environment(ws.entries)
 
         while requirements:
             # Process dependencies breadth-first.
@@ -721,7 +717,15 @@ class Installer(object):
             dist = best.get(req.key)
             if dist is None:
                 try:
-                    dist = env.best_match(req, ws)
+                    # Note that we first attempt to find an already active dist
+                    # in the working set. This will detect version conflicts.
+                    # XXX We expressly avoid activating dists in the entries of
+                    # the current working set: they might not reflect the order
+                    # of the environment. This is not so bad when the versions
+                    # are pinned, but when calling install(['zc.buildout']), it
+                    # can come up with completely different dists than the ones
+                    # currently running.
+                    dist = ws.find(req)
                 except pkg_resources.VersionConflict as err:
                     logger.debug(
                         "Version conflict while processing requirement %s "