rethink format and use of versions.txt

[jodh-intel]

The current https://github.com/01org/cc-oci-runtime/blob/master/versions.txt file has served us well, allowing us to specify particular versions of runtime source and package dependency versions.

However, we're at the point where we may need to rethink the format of this file. For example:

• PR #445 will add a useful feature whereby we record the versions of particular assets, but we may need more such variables.

• We currently specify the version of dependent source packages, but the download sites are hard-coded into the CI scripts.

• Although we download dependent source packages, we don't verify the integrity of the downloaded files in the CI environment.

We could just add lots of variables for each new attribute (that is the most flexible solution since the "database" is currently sourced into shell scripts and configure.ac).

Considerations

We need to store the following fields for packages:

• unique name for package
• package type (src archive, binary rpm, etc)
• package URL (site + path).
• package version
• package filename (which probably includes a version string).
• package filename checksum.
• checksum type (sha512, etc).
• optional comment

... but simple name=value pairs is also useful.

We should strive to keep the file as either a delimited text file, or maybe think about json and the tooling we'd need to call to extract required data. Alternatively, we could just have multiple database files:

• one for dependent packages (semi-colon delimited for example).
• one for name=value pairs which would be specifically used to record test data (such as that on PR #445).