Feat: request and check metadata before downloading the kpm dependencies

[liu-hm19]

Feature Request

Is your feature request related to a problem? Please describe:

Describe the feature you'd like:

Please request and check metadata of the local kpm packages before downloading the kpm dependencies declared in kcl.mod, avoiding re-downloading the package due to the absence of the kcl.mod.lock file.

Describe alternatives you've considered:

Teachability, Documentation, Adoption, Migration Strategy:

[Peefy]

Related Issue: #134

[Peefy]

I personally believe that the following points need to be clarified:

• Logic and checkpoints triggered by Git Source and OCI Source for re downloading.
• How to compare the consistency between remote source and local package.
• Do we need to check the local package checksum before running kcl? This may cause performance issues enhancement: kpm benchmark and improvement #295
• How go and rust deals re downloading?

[zong-zhe]

Addition

• A redownload of one dependency may result in a redownload of an indirect dependency

[Peefy]

1. Closed by feat: prohibit packaging and uploading when there are local dependencies #327 feat: remove keep AcquireDepSum() only in the downloading from OCI #330 fix: fix oci sum missing #331 fix: rm fetch metadata during loading kcl.mod #332