- the internal representation for package locks moves from `{Name, {pkg,
  PkgName, Vsn}, Lvl}` to `{Name, {pkg, PkgName, Vsn, Hash}, Lvl}`
- the internal representation for packages moves from `{pkg, PkgName,
  Vsn}` to `{pkg, PkgName, Vsn, Hash}`
- the hash can be `undefined`, meaning no check will be done
- no checking is done yet.

Uses global rebar config to see if user wishes to disable ssl verfication.
If {ssl_verify, false} is present certificates will not be verified.

Version #'s with patch info like "1.1.1-x" would cause an error. Now
tokenize the version string with "." AND "-".

This makes it obvious where packages are cached and when the cache is
being reused.

Messages are of the form:

===> Fetching recon ({pkg,<<"recon">>,<<"2.2.0">>})
===> Downloaded package, caching as
$HOME/.cache/rebar3/hex/default/packages/recon-2.2.0.tar

and

===> Fetching recon ({pkg,<<"recon">>,<<"2.2.0">>})
===> Version cached at
$HOME/.cache/rebar3/hex/default/packages/recon-2.2.0.tar is up
to date, reusing it

- The rebar package index files have been moved off the default path and
  will require a new `rebar3 update`
- Caching of downloaded packages automatically takes place in a path
  relative to the CDN used
- The cache path is not shared with hex as we now write and modify data
  in there arbitrarily
- Basic tests plus the working set for more of them is included

- Track level of packages properly, they're not level 0 anymore (this
  could yield an issue where a src dep takes precedence over a pkg dep)
- Proper stable sort of vertices in the digraph module
- PkgDeps no longer 'see themselves' when fetching and upgrading after
  locking themselves
- Pkg Locks are added to pkg deps rather than source deps
- Updating test cases to support pkg mocking on top of src mocking