Partially reverts commit f52a115ea9

Fixes #2003

Needs tests to prevent a future regression.

For issue https://github.com/erlang/rebar3/issues/1974
Revert "add rebar.lock to template gitignore"

This reverts commit 8fb8a91130.

For issue https://github.com/erlang/rebar3/issues/1974

This PR is a simpler and mergeable version of #1853 by @shamis, since
the provider changed format enough to make merging difficult.

Compared to #1853, this also puts the responsibility on each resource to
check rather than adding a new optional callback.

The process dictionary is use as a warning/check cache.

* update to hex_core for hex-v2 repo support (#1865)

* update to hex_core for hex-v2 repo support

This patch adds only single repo hex-v2 support through hex_core.
Packages no longer filtered out by buildtool metadata and the
package index is updated per-package instead of fetched as one
large ets dump.

* tell travis to also build hex_core branch

* support list of repos for hex packages (#1866)

* support list of repos for hex packages

repos are defined under the hex key in rebar configs. They can be
defined at the top level of a project or globally, but not in
profiles and the repos configured in dependencies are also ignored.

Searching for packages involves first checking for a match in the
local repo index cache, in the order repos are defined. If not found
each repo is checked through the hex api for any known versions of
the package and the first repo with a version that fits the constraint
is used.

* add {repos, replace, []} for overriding the global & default repos

* add hex auth handling for repos (#1874)

auth token are kept in a hex.config file that is modified by the
rebar3 hex plugin.

Repo names that have a : separating a parent and child are considered
organizations. The parent repo's auth will be included with the child.
So an organization named hexpm:rebar3_test will include any hexpm
auth tokens found in the rebar3_test organization's configuration.

* move packages to top level of of hexpm cache dir (#1876)

* move packages to top level of of hexpm cache dir

* append organization name to parent's repo_url when parsing repos

* only eval config scripts and apply overrides once per app (#1879)

* only eval config scripts and apply overrides once per app

* move new resource behaviour to rebar_resource_v2 and keep v1

* cleanup use of rebar_resource module and unused functions

* cleanup error messages and unused code

* when discovering apps support mix packages as unbuilt apps (#1882)

* use hex_core tarball unpacking support in pkg resource (#1883)

* use hex_core tarball unpacking support in pkg resource

* ignore etag if package doesn't exist and delete if checksum fails

* add back tests for bad package checksums

* improve bad registry checksum error message

This replaces all deprecated function usage by alternative ones based on
a version switch enacted at compile time, preventing all warnings.

This will likely introduce some possible runtime errors in using a
Rebar3 compiled on OTP-20 or OTP-21 back in versions 19 and earlier, but
we can't really work around that.

A bunch of dependencies have been updated to support OTP-21 without
warnings as well.

Those aren't supported and so a warning should be output. Fixes #1003

This is done through 3 main change groups:

- replacing `~s` by `~ts` in format strings, so that strings that
  contain unicode are properly printed rather than crashing
- adding the `unicode` argument to all function of the `re` module to
  ensure transformations on strings containing unicode data are valid
  instead of crashing (see issue #1302)
- replacing `ec_cnv:to_binary/1` and `ec_cnv:to_list/1` with matching
  functions in `rebar_utils`.

The last point has been done, rather than modifying and updating erlware
commons, because binary and list conversions can be a contentious
subject. For example, if what is being handled is actually bytes from a
given binary stream, then forcing a byte-oriented interpretation of the
data can corrupt it. As such, it does not appear safe to modify erlware
commons' conversion functions since it may not be safe for all its
users.

Instead, rebar3 reimplements a subset of them (only converting
atoms and chardata, ignoring numbers) with the explicit purpose of
handling unicode string data.

Tests were left as unchanged as possible. This may impact the ability to
run rebar3's own suites in a unicode path, but respects a principle of
least change for such a large patch.

86e883b8d8 always returns the full length SHA,
therefore when using a dependency having the short SHA,
it'll always consider that the SHAs are different,
hence it'll alway return true for .

The option --single-branch was introduced in git version 1.7.10 and
thus rebar3 cannot fetch git dependencies on systems where earlier
git versions are install.

This commit will select other git clone commands if an earlier git
version is detected. If the git version cannot be determined rebar3
falls back on the previous behavior and uses --single-branch.

fix issue #1185 git working directory issues due to command line options in Windows

I've tried to compile project with git in .app.src vsn
Project was tagged as 1.0.0, but resulting .app vsn becomes 1.0.0+build.6.reff0aec24

```git lg
* f0aec24 - (80 минут назад) Fixed ct — Kozlov Yakov (HEAD -> master, tag: 1.0.0, origin/master)
... 5 commits before
```

```
$ git log --oneline --no-walk --tags --decorate
f0aec24 (HEAD -> master, tag: 1.0.0, origin/master) Fixed ct
```

I've found that `HEAD -> master` doest match pattern in [rebar_git_resource](https://github.com/erlang/rebar3/blob/master/src/rebar_git_resource.erl#L204)

In the scenario we that we have selected a commit
that is between two tags, we should base the
version on the most recent tag we can see in the
revision history, but we should not treat this as
the tag version.

`git describe --tags --abbrev=0` finds the most
recent tag visible in the revision history from
the current HEAD. Return this as the version
string and undefined as the tag to trigger ref
counting.

In the scenario that someone had cloned an entire
repository and then checked out an older version
tag, the semantic versioning would detect the
newest tag, not the checked out tag. Look for
the HEAD string prior to tag: to indicate the
currently selected tag.

In the scenario we that we have selected a commit
that is between two tags, we should base the
version on the most recent tag we can see in the
revision history, but we should not treat this as
the tag version.

`git describe --tags` finds the most recent tag
visible in the revision history from the current
HEAD. Return this as the version string and
undefined as the tag to trigger ref counting.

In the scenario that someone had cloned an entire
repository and then checked out an older version
tag, the semantic versioning would detect the
newest tag, not the checked out tag. Look for
the HEAD string prior to tag: to indicate the
currently selected tag.

Not all repositories use a v-prefix for version
tags. All tags should be considered valid
versions.

Changes parse_git url function to use Using RFC3986 standard to validate
git uri instead of matching strings in function head. Also accepts scp
style syntax for parsing.

Basic escaping is done only. Fancy hex sequences are not covered, but
this should otherwise take care of the most common issues.

Fixes #497

* fix shell commands relying on non windows shell commands
* fix shell commands using wrong quotes
* implement native wc -l