Fix #744: Allow _checkouts dep to override pkg dep not in registry

[tsloughter]

Fix for #744 but won't make sense until after #760 is merged because it builds on it.

[ferd]

I would probably prefer if we explicitly set the version value to something like checkout rather than undefined to keep it obvious that this is the only context where this should happen?

The one thing I'm not sure I get is why is the appinfo record requiring to get its deps inserted there wheras the source deps don't need to, and neither actually did before this patch. It seems like only the first and last clause should otherwise be required?

[tsloughter]

It can't be checkout, it is even before we discover it is in _checkouts that we are passing undefined as the version. That is simply the case where in rebar.config you don't put a version on the package, meaning for it to find and lock on the highest version available.

The deps are being added to app_info in the case of pkgs because we need to verify the package is in the registry anyway, so we may as well use the lookup that does this to get the deps and set them. In the case of a source dep we haven't yet fetched the dep so we can't set its dependencies at this point.

[ferd]

Ah yeah I see, it was in pkg_to_app before. Got it.