arguments to ensure compile results as as intended

Apps that are no longer used are not automatically deleted, but we tell
users it can be done. This is safer while we're not sure of the
correctness of these messages.

Error messages are added for transient dependencies and dependencies not
found.

- Many apps is supported through and through
- Not mentioning any app upgrades all apps
- Locks are refreshed on disk and tested as such after an upgrade

todo:
- relock stuff
- default to all apps needing upgrade
- more tests?
- pkgs?

Only the most complex case is failing, where cross-dependencies would
need to be refetched as an update clears an app of its dependencies and
a different subtree should override it.

The problem with the current effort is handling of transitive dependency
upgrades and possible values.

Test that all the correct locks are set for an upgrade run.

Now to actually re-run the install deps and prove it works

commands

Change mock_pkg_resource to use rebar_test_utils:create_empty_app so
that an ebin directory is created which is a good expectation for a
package. Also revert the check in rebar_fetch:download_source to check
for an ebin directory before adding it to the code path for package
installs. If a package does not have an ebin directory it is probably
a good for an exception to be thrown.

* Add a provider for the xref tool for running cross reference
  analysis on a project. Most of the code has been ported directly
  from the rebar2 rebar_xref module with some modification and cleanup
  to support testing.
* Port over the eunit test suite from rebar2, but convert it to
  common_test. The testing is the same, but now the
  erlang term output is examined to determine if the test run is successful
  instead of scanning the console output for the expected strings.

swap `file:list_dir` for `file:list_dir_all` due to nonexistence of latter prior to r16x

(in `rebar_file_utils`)

- Includes tests for templates and their application

Now supports arbitrary commands

- Adding tests for package deps
- Adding conflict/override warnings for package deps
- Adding cycle detection for packages
- Adding cycle detection for mixed packages+source
- Fixing internal dependency format of package resources when converted
  to rebar_app_info
- normalizing level-order prioritization to be based on lexicographical
  sort of app names rather than traversal order (which is undefined for
  package deps)
- Fixing tests for source deps for deep cycle detection
- Fixing bugs with source deps
- Relaxed version format checks for test utils

A lot of fixes are combined in there because I didn't want to commit
non-passing code, and many bugs were found when adding the second batch
of tests as part of the original effort.

The case in mind here is due to conflicts, and tests have been added for
this.

- Adding tests
- fixing use of set fetching to find repeated deps and prevent infinite
  loops

On a circular loop rebar3 now fails with `{error, no_sort}`, which is
uncaught and should be handled to consider the issue fully fixed.

- Reworked the helpers for existing suites and expanded them
- Created a mock git resource module to test for its dependency fetching
- Added a test suite for dependency resolving with first checks for
  common cases (https://gist.github.com/ferd/197cc5c0b85aae370436)

Left to do would include:

- Verify warnings
- Verify failures
- Verify dependency updates resolving

As mentioned in the OTP documentation, licensed customers may use
patched OTP installations where the otp_patch_apply tool adds a '**'
suffix as a flag saying the system consists of application versions from
multiple OTP versions. When we get such a version string, we drop the
suffix, as we cannot obtain relevant information from it as far as
tooling is concerned.

Augment 'tests' option of 'rebar eunit' command with ability to specify
tests to run using module-qualified names. This change also forced me
to change the way modules for coverage and for testing itself are
selected - module-qualified tests specifications are now taken into
consideration. Extend tests to cover new functionality. Update
dialyzer_reference accordingly.

While at it, improve the error message printed by rebar_utils:sh/2.

Allow rebar to compile applications using Erlang/OTP 17 and older
versions.  This patch only provides partial support since the rebar
tool itself must be compiled using an Erlang/OTP version that is older
than 17.

It is a portable version of the realpath(1) utility that you can find on
Mac OS X and FreeBSD (see also The Open Group Base Specifications Issue
6, IEEE Std 1003.1).

Without the -P flag, pwd(1) might return different values when the
current path contains one or more symlinks, depending on how you got
into the current directory.

In simplenode.runner, this may cause PIPE_DIR to have different values
on each use, which will make it impossible to connect to the running
node unless you guess the correct path yourself.