- Track level of packages properly, they're not level 0 anymore (this
  could yield an issue where a src dep takes precedence over a pkg dep)
- Proper stable sort of vertices in the digraph module
- PkgDeps no longer 'see themselves' when fetching and upgrading after
  locking themselves
- Pkg Locks are added to pkg deps rather than source deps
- Updating test cases to support pkg mocking on top of src mocking

Old one might have been a mistake; this one works fine.

- Make functions shorter
- Unnest some functions
- Split up and give names to major conditional branches

todo:
- relock stuff
- default to all apps needing upgrade
- more tests?
- pkgs?

- rename 'update' to 'upgrade' -- 'update' stands for package list
  updates, not dependencies upgrades
- extracting some deeply nested code

Only the most complex case is failing, where cross-dependencies would
need to be refetched as an update clears an app of its dependencies and
a different subtree should override it.

Test that all the correct locks are set for an upgrade run.

Now to actually re-run the install deps and prove it works

- Adding tests for package deps
- Adding conflict/override warnings for package deps
- Adding cycle detection for packages
- Adding cycle detection for mixed packages+source
- Fixing internal dependency format of package resources when converted
  to rebar_app_info
- normalizing level-order prioritization to be based on lexicographical
  sort of app names rather than traversal order (which is undefined for
  package deps)
- Fixing tests for source deps for deep cycle detection
- Fixing bugs with source deps
- Relaxed version format checks for test utils

A lot of fixes are combined in there because I didn't want to commit
non-passing code, and many bugs were found when adding the second batch
of tests as part of the original effort.

The case in mind here is due to conflicts, and tests have been added for
this.

- Adding tests
- fixing use of set fetching to find repeated deps and prevent infinite
  loops

On a circular loop rebar3 now fails with `{error, no_sort}`, which is
uncaught and should be handled to consider the issue fully fixed.