Don't rely on Hash for Package deduplicating

[alexcrichton]

The fix in #1697 was to alter the Hash implementation of Package to take
into account the source root instead of just the package id (so packages at the
same source would have the same hash). There's a spot, however, where we
normalize some paths and not others, causing two paths which logically point the
same location end up having different hashes, so the same package ended up being
stored multiple times, later leading to an assertion that there was only one
stored.

This commit alters the behavior of read_packages to keep a hash map of ID =>
Package instead of just a hash set of Package as the deduplication/equality
needs to be based on the ID, not the literal path to the source root.

This specific bug shows up when you have an override and a normal dependency
pointing at the same location (and the override has some inter-dependencies).
Not exactly a normal use case, but it showed up in Servo's build!

[alexcrichton]

r? @brson

[rust-highfive]

r? @huonw

(rust_highfive has picked a reviewer for you, use r? to override)

[brson]

@bors r+

[bors]

📌 Commit 06a0605 has been approved by brson

[bors]

⌛️ Testing commit 06a0605 with merge d406d25...

[bors]

☀️ Test successful - cargo-linux-32, cargo-linux-64, cargo-mac-32, cargo-mac-64, cargo-win-gnu-32, cargo-win-gnu-64