Whenever files were being locked *and* provided in rebar.config
duplicates could be printed. This is taken care of.

Also whenever atom packages were being used, they would cause the merge
step to fail. The new format does proper name-based deduplication of
resources, giving priority to locks to work.

ModificatioN/needs-update support is still in.

This may also act as a fix for #341, if automation isn't required too
much.

They can be culled and reused in one sort pass.

Should fix #360

Conflicts:
	src/rebar_state.erl

Allows to remove entries from the lock file, or the lock file as a
whole.

When fetching dependencies for the first time using a profile (`rebar3
as prod release` or `rebar3 ct`), the dependencies get fetched into the
non-default profile. This has two consequences:

- the files get re-downloaded on follow-up runs
- the lock file includes incomplete or too many deps in its list

This patch forces dependencies in the default profile to be stored in
_build/default/lib even when running under other profiles, then symlinks
them to the correct one.

This makes it so common dependencies in 'default' be downloaded there
and avoids re-downloading them. Should also fix the lock issues.

fixes #331