defend against dependency confusion attack

like @abbrent said, using own packages like tsm-datastore-lib and minio-cli-wrapper has the risk for this:

We should host own packages also at PyPI (prevents loss of package-name to attackers which could find our package names maybe by shodan).

@schaefed @palmb How is SaQC team handling this?