Resolver: project source deduplication policy

[andrius-puksta-sensmetry]

Currently the storage chosen to obtain a project is decided non-deterministically by pubgrub::resolve. Which source to use has to be a policy decision, and we should consider at least Cargo, uv, pip, Maven, npm and similar to avoid making the same mistakes as e.g. pip.

Simple options:

• choose a local source where available
• choose always the first source that is available. Similar to uv.
• choose a source per-usage: only usages with the same source specified get the same source. E.g. cargo does this.
• choose any source: effectively what happens currently

[andrius-puksta-sensmetry]

Terms:

• source: implicit or explicit place to obtain the project (similar to lockfile source, but includes PURL identifiers, which are resolved to whatever index)
• local source: local path source (i.e. non-kpar) or (maybe) local path kpar
• remote source: everything else: URL, index, git

Preliminary policy (discussed with Vytautas):

• directly depending on a local source overrides any transitive dependencies of the same project, but it must match all version constraints introduced by those transitive dependencies
• any other mismatch anywhere in the dependency graph (e.g. direct remote + indirect local, two different indirect remote sources, two different indirect local sources, etc.): error out - no automatic choice will be consistent with user expectations, so let the user deal with it