Instead fetching and resolving src deps (which could depend on pkg deps)
and then pkg deps this patch combines the two into a single set of
iterations by level. The only difference between src and pkg deps in this
new install_deps is how their deps list is found -- from the config or
lock file for src deps and from the neighbors of the vertex for pkg.

Requires a rework of other test suites using the same dep-handling
mechanism.

Test that all the correct locks are set for an upgrade run.

Now to actually re-run the install deps and prove it works

Now supports arbitrary commands

- Adding tests for package deps
- Adding conflict/override warnings for package deps
- Adding cycle detection for packages
- Adding cycle detection for mixed packages+source
- Fixing internal dependency format of package resources when converted
  to rebar_app_info
- normalizing level-order prioritization to be based on lexicographical
  sort of app names rather than traversal order (which is undefined for
  package deps)
- Fixing tests for source deps for deep cycle detection
- Fixing bugs with source deps
- Relaxed version format checks for test utils

A lot of fixes are combined in there because I didn't want to commit
non-passing code, and many bugs were found when adding the second batch
of tests as part of the original effort.

The case in mind here is due to conflicts, and tests have been added for
this.

- Adding tests
- fixing use of set fetching to find repeated deps and prevent infinite
  loops

On a circular loop rebar3 now fails with `{error, no_sort}`, which is
uncaught and should be handled to consider the issue fully fixed.

- Reworked the helpers for existing suites and expanded them
- Created a mock git resource module to test for its dependency fetching
- Added a test suite for dependency resolving with first checks for
  common cases (https://gist.github.com/ferd/197cc5c0b85aae370436)

Left to do would include:

- Verify warnings
- Verify failures
- Verify dependency updates resolving