- vendor in hex_core at v0.5.0
  - Change where repo_name should be the org and not the parent
  - Changed rebar_utils:url_append_path/2 to not explicitly add a '?',
    this is returned in the Query chunk by http_uri:parse/1 (e.g., "?foo=bar")
  - update organization_merging test to expect the sub-repo as the repo_name
  - Add tests for rebar_utils:url_append_path/2
  - Stop referencing/setting "organization" in config and use new
     organization settings (api_repository and repo_organization)
  - Do not set (assume) the read key is valid for any/every repo
  - Set repo_organization and api_repository to org
  - Update tests to check for new config opts

retired packages are now used the same as any other but
a warning will be printed when it is resolved.

prerelease versions are skipped unless explicitly given
as the version in the constraint or lock file.

* update to hex_core for hex-v2 repo support (#1865)

* update to hex_core for hex-v2 repo support

This patch adds only single repo hex-v2 support through hex_core.
Packages no longer filtered out by buildtool metadata and the
package index is updated per-package instead of fetched as one
large ets dump.

* tell travis to also build hex_core branch

* support list of repos for hex packages (#1866)

* support list of repos for hex packages

repos are defined under the hex key in rebar configs. They can be
defined at the top level of a project or globally, but not in
profiles and the repos configured in dependencies are also ignored.

Searching for packages involves first checking for a match in the
local repo index cache, in the order repos are defined. If not found
each repo is checked through the hex api for any known versions of
the package and the first repo with a version that fits the constraint
is used.

* add {repos, replace, []} for overriding the global & default repos

* add hex auth handling for repos (#1874)

auth token are kept in a hex.config file that is modified by the
rebar3 hex plugin.

Repo names that have a : separating a parent and child are considered
organizations. The parent repo's auth will be included with the child.
So an organization named hexpm:rebar3_test will include any hexpm
auth tokens found in the rebar3_test organization's configuration.

* move packages to top level of of hexpm cache dir (#1876)

* move packages to top level of of hexpm cache dir

* append organization name to parent's repo_url when parsing repos

* only eval config scripts and apply overrides once per app (#1879)

* only eval config scripts and apply overrides once per app

* move new resource behaviour to rebar_resource_v2 and keep v1

* cleanup use of rebar_resource module and unused functions

* cleanup error messages and unused code

* when discovering apps support mix packages as unbuilt apps (#1882)

* use hex_core tarball unpacking support in pkg resource (#1883)

* use hex_core tarball unpacking support in pkg resource

* ignore etag if package doesn't exist and delete if checksum fails

* add back tests for bad package checksums

* improve bad registry checksum error message

- the internal representation for package locks moves from `{Name, {pkg,
  PkgName, Vsn}, Lvl}` to `{Name, {pkg, PkgName, Vsn, Hash}, Lvl}`
- the internal representation for packages moves from `{pkg, PkgName,
  Vsn}` to `{pkg, PkgName, Vsn, Hash}`
- the hash can be `undefined`, meaning no check will be done
- no checking is done yet.

Instead fetching and resolving src deps (which could depend on pkg deps)
and then pkg deps this patch combines the two into a single set of
iterations by level. The only difference between src and pkg deps in this
new install_deps is how their deps list is found -- from the config or
lock file for src deps and from the neighbors of the vertex for pkg.

they would always be left unfound otherwise.

- Track level of packages properly, they're not level 0 anymore (this
  could yield an issue where a src dep takes precedence over a pkg dep)
- Proper stable sort of vertices in the digraph module
- PkgDeps no longer 'see themselves' when fetching and upgrading after
  locking themselves
- Pkg Locks are added to pkg deps rather than source deps
- Updating test cases to support pkg mocking on top of src mocking

Change mock_pkg_resource to use rebar_test_utils:create_empty_app so
that an ebin directory is created which is a good expectation for a
package. Also revert the check in rebar_fetch:download_source to check
for an ebin directory before adding it to the code path for package
installs. If a package does not have an ebin directory it is probably
a good for an exception to be thrown.

- Adding tests for package deps
- Adding conflict/override warnings for package deps
- Adding cycle detection for packages
- Adding cycle detection for mixed packages+source
- Fixing internal dependency format of package resources when converted
  to rebar_app_info
- normalizing level-order prioritization to be based on lexicographical
  sort of app names rather than traversal order (which is undefined for
  package deps)
- Fixing tests for source deps for deep cycle detection
- Fixing bugs with source deps
- Relaxed version format checks for test utils

A lot of fixes are combined in there because I didn't want to commit
non-passing code, and many bugs were found when adding the second batch
of tests as part of the original effort.