Add check that hot-switching from default to alternate Source is "safe"

[sdboyer]

trafficstars

When ProjectIdentifier.Source is empty for a given project, it's possible for a later dependency on that same project to come along and specify a ProjectIdentifier.Source, and the solver will transparently allow the switch to the alternate source location.

This is useful because it allows (one) project to specify an alternate source location - primarily, a fork - and have other dependers on that project just go along for the ride. Not having this feature would make specifying a fork of a shared dep nearly impossible; all the dependers on it would need to explicitly specify the fork. However, right now, we don't really do any checks to ensure that this hot-switching of source locations is actually safe - we just make a simple check, and off we go.

TBH, I'm not even sure what "safe" would even mean here, as the express purpose of having a fork is to use a modified version of the code, which necessarily means relying on a different version. We need better, clearer definitions.

[fabulous-gopher]

This issue was moved to golang/dep#428