feat: support multiple URLs in sources

[jjmaestro]

Fixes #113

The Debian snapshot mirror fails quite often and, while the Cloudflare mirror has had some issues in the past (e.g. it was lagging replication for months) it's much more reliable.

This commit adds support for multiple URLs in the manifest. See examples/debian_snapshot/bullseye.yaml for a sample usage.

[thesayyn]

You need a rebase here; so far looks okay to me.

[jjmaestro]

This commit fixes the buildifier issues. I'll make the changes to the lock now.

[jjmaestro]

@thesayyn thinking more about the lockfile, I was considering the "breaking change" and wondering if you would want / prefer the approach I did in #95: supporting v1 and a new v2, having auto-migration, etc.

If so, maybe you could consider (1) landing this PR as-is and (2) either checking the last comments I did on #93 so I could move that forward and then add the urls to #95... or I could also re-do #95 from scratch without depending on #93.

I'm just thinking that it would be nice to avoid the breaking change... let me know what you think!

[thesayyn]

Since we are pre 1.0 i'd be okay with just breaking things, that said maybe we could be less sensitive about url vs urls in the lockfile, accept both?

[jjmaestro]

maybe we could be less sensitive about url vs urls in the lockfile, accept both?

true, true, sounds like a good compromise for now, I think! Same way the manifest can have both...

OK, I'll go about this and we can go over the other PRs later on (ah, that huge stack... I would definitely do things differently now XXD)

[jjmaestro]

@thesayyn I've added urls to the lock, I've tested it manually with the original lockfiles and with an updated lockfile. Also, I've left all the lockfiles in "the old format" (with url), let me know if you want to update them all now or leave them as-is for later.

[thesayyn]

LGTM, one small nit