* support list of repos for hex packages

repos are defined under the hex key in rebar configs. They can be
defined at the top level of a project or globally, but not in
profiles and the repos configured in dependencies are also ignored.

Searching for packages involves first checking for a match in the
local repo index cache, in the order repos are defined. If not found
each repo is checked through the hex api for any known versions of
the package and the first repo with a version that fits the constraint
is used.

* add {repos, replace, []} for overriding the global & default repos

* update to hex_core for hex-v2 repo support

This patch adds only single repo hex-v2 support through hex_core.
Packages no longer filtered out by buildtool metadata and the
package index is updated per-package instead of fetched as one
large ets dump.

* tell travis to also build hex_core branch

Getting real tired of that nondeterministic set of runs on OSX CI

This adds tracking of package hash in the in-memory index rather than
the current `undefined' values.

According to the test added, this is not necessary for transitive
package dep hash chcking, but does result in a more complete index search
result when doing app lookups, and could yield some optimizations on
hash checks by checking from the index structure before fetching a package.

Tests have broken as locks were expanded and auto-filled newer versions
of lockfiles. This fixes them back.