We used to be storing packages from HTTP hosted sources in directories
named after the hostname. There was no distinction between a package
from an HTTP source and an HTTPS source with the same name. This was
contrary to the rest of pub's logic, which considered those different
sources.

Closes #1418

R=rnystrom@google.com

Review URL: https://codereview.chromium.org//2028853002 .

If a path dependency had a dependency back on the root package, it
would be detected as always stale because the root package isn't in the
lockfile. This changes the check to always consider that fresh, since
all dependencies on the root package are satisfied.

Closes #1416

R=rnystrom@google.com

Review URL: https://codereview.chromium.org//1985063004 .

OfflineHostedSource was failing to parse the directory names for
prerelease package versions correctly.

Closes #1415

R=rnystrom@google.com

Review URL: https://codereview.chromium.org//1971523002 .

We no longer include overridden dependencies' constraints, since those
constraints aren't checked when doing version resolution. In the worst
case, including them caused us to generate invalid lockfiles with
"<empty>" as the SDK constraint.

R=rnystrom@google.com

Review URL: https://codereview.chromium.org//1956613002 .

We had a logic error wherein we were checking dependencies only
for cached packages when we should have been checking them only
for *uncached* packages.

R=rnystrom@google.com

Review URL: https://codereview.chromium.org//1956543002 .