Instead fetching and resolving src deps (which could depend on pkg deps)
and then pkg deps this patch combines the two into a single set of
iterations by level. The only difference between src and pkg deps in this
new install_deps is how their deps list is found -- from the config or
lock file for src deps and from the neighbors of the vertex for pkg.

Linking message will only be printed the first time the link or copy
actually happens.

Note:

rebar_file_utils:symlink_or_copy will now return 'exists'
instead of ok, if it did nothing because the link exists.

Nothing was checking the return value yet, so seemed reasonable.

- Crashes in providers lib when no providers in a namespace are bare
- Making sure bareness matches semantics; i.e. a bare provider is
  visible, a non-bare provider is hidden.

They can be culled and reused in one sort pass.

Should fix #360

When fetching dependencies for the first time using a profile (`rebar3
as prod release` or `rebar3 ct`), the dependencies get fetched into the
non-default profile. This has two consequences:

- the files get re-downloaded on follow-up runs
- the lock file includes incomplete or too many deps in its list

This patch forces dependencies in the default profile to be stored in
_build/default/lib even when running under other profiles, then symlinks
them to the correct one.

This makes it so common dependencies in 'default' be downloaded there
and avoids re-downloading them. Should also fix the lock issues.