Deps: several sources per dependency #231

Part of #227. Proposal: ComlineProject/docs#163, proposals/offline/supply.md#several-sources-per-dependency.

• One identity (version or commit, plus hash) with an ordered sources = [...]: the official registry, custom registries, git.
• More than one source requires a hash. An unreachable source, or one without the content, falls through to the next; a mismatch is a hard error.
• The root package may add sources for a transitive dependency whose pin carries a hash. It adds and never replaces; patching is out of scope.
• Order: machine and organisation mirrors first, then the root's additions, then the package's own sources. Offline, only local sources count.
• The build reports which source served each dependency (verbose and --json). This is never frozen.