[Package Upgrades] Record Published Address

[amnn]

Part of #2045

With the introduction of Package Upgrades, it is no longer possible to determine the address that a package is published to by looking at its module self-addresses: A module's self-address always corresponds to the address it was first published at. Subsequent upgrades will retain this self-address, but will be published to new addresses.

To allow one package to depend on another, we now need to introduce a new field to the package, indicating the address it is published at. One option is to introduce this field to the manifest, and require that developers update it manually on publish.

Steps

• [ ] (If using manifest) Register a custom PackageHook that adds the published-at field to the manifest.
• [ ] Gather the transitive dependencies of a package during publish, and check that they all have a published-at address, unless --with-unpublished-dependencies is provided.
• [ ] Document the importance of the published-at field, and error cases if dependencies do not include this field.

Further Work

• https://github.com/MystenLabs/sui/issues/8345