escriptize dependency handling is broken

[kaharlichenko]

This includes two cases:

1. the package dependencies which are not listed in {applications, ...} in app.src, but are listed in {deps, [...]} in rebar.config get included in the resulting escript even though the should not;
2. the source dependencies which are listed in {applications, ...} in app.src don't get included in the resulting escript even though they should.

Discovered while discussing #1137.

Attaching minimal project that reproduces both cases: rebar-1139.tar.gz.

[kaharlichenko]

According to @ferd

The rebar3 deps are instructions to fetch dependencies, not necessarily to represent which app depends on them.

Looks like this is not the case with escriptize:

1. in rebar_prv_escriptize:escriptize it can be seen here that the list of all the package dependencies is passed to escript:create;
2. all_deps fetches the package dependencies from the State here;
3. the State is populated with the list of all the package dependencies in rebar_prv_install_deps.erl;
4. rebar_prv_install_deps:do seems to be called before rebar_prv_escriptize:do due to plugin dependency chain: escript -> compile -> lock -> install_deps.

This way all the {deps, [...]} specified in rebar.config (be it top-level or application-level one) get unconditionally included into the final escript instead of relying on {applications, ...} property of app.src.

[ferd]

@madkinder please see #1249 -- it may fix your issues there.