Source provenance API for multiple-source source plugins

[abderrahim]

#2009 added the possibility to manually annotate sources with additional source provenance information that isn't part of the source configuration, such as the home page and the issue tracker. However, this applies to all SourceInfo produced by the source plugin.

This is problematic for source plugins such as cargo which download multiple archives/repositories based on a lock file from a previous source. Each of these archives/repositories needs to have its own provenance information. In addition it would be nice for the plugin to be able to pre-fill some information.

Adding some ideas from @gtristan:

We could:

• Add a type, e.g. SourceProvenanceAttrs, something specifically to describe the provenance block parsed by Source which represents "Source provenance values which are explicitly declared by project authors"
• Have a @classmethod to create it from a node SourceProvenanceAttrs.new_from_node() (similar to what we have for a few types), along with a normal constructor with all keyword arguments for the attributes.
• Add a SourceProvenanceAttrs keyword argument to Source.create_source_info(), which if specified, is used to provide these attributes rather than the ones specified at the toplevel source.

We could take this one step further and add a class level flag Source.BST_CUSTOM_SOURCE_PROVENANCE, which; if set to True, causes the "provenance" attribute on sources to be an invalid key (preventing project authors from writing toplevel "provenance" attributes on sources like cargo which support that in a custom way instead) - this could also trigger an assertion in Source.create_source_info() if the source fails to provide the attributes.