More details of project provenance should be stored and shared

[quicklisp]

The controller fetches a lot of projects from a lot of different sources to compile a dist. There is some information about where the projects are generally fetched in https://github.com/quicklisp/quicklisp-projects/ but it doesn't tell you where the .tgz file for a project in a given dist came from.

It would be good to track, for each dist build, where exactly a project's sources came from, with the goal of making it easy for a third party to independently get the source for whatever purpose.

That kind of information varies by upstream project source type:

• git: include the repo URL and commit id
• svn: repo URL and revision
• darcs: repo URL and changes file
• http/https: URL, date fetched, headers

Collecting that information is half the work. The other half is storing it in a way that is easily accessible, possibly with some enhancement to the quicklisp client code.