Instead fetching and resolving src deps (which could depend on pkg deps)
and then pkg deps this patch combines the two into a single set of
iterations by level. The only difference between src and pkg deps in this
new install_deps is how their deps list is found -- from the config or
lock file for src deps and from the neighbors of the vertex for pkg.

Just rework the error message.

On a single app's dep list, the first noted wins if there's a duplicate
between packages and sources, rather than favoring source there anyway.

Requires a rework of other test suites using the same dep-handling
mechanism.

In the spirit of Original Rebar's "require_min_otp_vsn", this adds
rebar_utils:check_min_otp_version/1 (taking a string containing the
minimum version) and rebar_utils:check_blacklisted_otp_versions/1
(taking a list of regular expression strings), as well as tests in
rebar_utils_SUITE. They're currently only called by the tests-
how/where to best place calls to them from non-test code needs to be
determined (at which point two corresponding rebar.config keys can be
supported). For example, the version probably shouldn't be enforced when
just running "rebar3 help".

and replace with `cover_opts`

Test required `touch` utility to present on user's machine. Remove this dependency.

Seed random with erlang:now() because os:timestamp precision is not enough
on windows.