- the internal representation for package locks moves from `{Name, {pkg,
  PkgName, Vsn}, Lvl}` to `{Name, {pkg, PkgName, Vsn, Hash}, Lvl}`
- the internal representation for packages moves from `{pkg, PkgName,
  Vsn}` to `{pkg, PkgName, Vsn, Hash}`
- the hash can be `undefined`, meaning no check will be done
- no checking is done yet.

Instead fetching and resolving src deps (which could depend on pkg deps)
and then pkg deps this patch combines the two into a single set of
iterations by level. The only difference between src and pkg deps in this
new install_deps is how their deps list is found -- from the config or
lock file for src deps and from the neighbors of the vertex for pkg.

Just rework the error message.

On a single app's dep list, the first noted wins if there's a duplicate
between packages and sources, rather than favoring source there anyway.

Requires a rework of other test suites using the same dep-handling
mechanism.

Should fix #360

When fetching dependencies for the first time using a profile (`rebar3
as prod release` or `rebar3 ct`), the dependencies get fetched into the
non-default profile. This has two consequences:

- the files get re-downloaded on follow-up runs
- the lock file includes incomplete or too many deps in its list

This patch forces dependencies in the default profile to be stored in
_build/default/lib even when running under other profiles, then symlinks
them to the correct one.

This makes it so common dependencies in 'default' be downloaded there
and avoids re-downloading them. Should also fix the lock issues.

The option {deps_error_on_conflict, true} will make it so conflicts in
deps being fetched interrupts the operation rather than just display a
warning.

Defaults to `false'.

Test that all the correct locks are set for an upgrade run.

Now to actually re-run the install deps and prove it works

Now supports arbitrary commands

- Adding tests for package deps
- Adding conflict/override warnings for package deps
- Adding cycle detection for packages
- Adding cycle detection for mixed packages+source
- Fixing internal dependency format of package resources when converted
  to rebar_app_info
- normalizing level-order prioritization to be based on lexicographical
  sort of app names rather than traversal order (which is undefined for
  package deps)
- Fixing tests for source deps for deep cycle detection
- Fixing bugs with source deps
- Relaxed version format checks for test utils

A lot of fixes are combined in there because I didn't want to commit
non-passing code, and many bugs were found when adding the second batch
of tests as part of the original effort.

The case in mind here is due to conflicts, and tests have been added for
this.

- Adding tests
- fixing use of set fetching to find repeated deps and prevent infinite
  loops

On a circular loop rebar3 now fails with `{error, no_sort}`, which is
uncaught and should be handled to consider the issue fully fixed.

- Reworked the helpers for existing suites and expanded them
- Created a mock git resource module to test for its dependency fetching
- Added a test suite for dependency resolving with first checks for
  common cases (https://gist.github.com/ferd/197cc5c0b85aae370436)

Left to do would include:

- Verify warnings
- Verify failures
- Verify dependency updates resolving