package.category doesn't make a lot of sense in the richer world of dependency groups.

The only use that is made of the category in poetry and poetry-core is that it is written to and read back from the lockfile. But no use is made of that information.

Explicit sources are considered only for packages that explicitly indicate their source.

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

sources: introduce "priority" key for sources and deprecate flags "default" and "secondary", adjust cli accordingly (#7658)

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

Currently, poetry install will clone, build and install every git
dependency when it's not present in the environment. This is OK for
developer's machines, but not OK for CI - there environment is always
fresh, and installing git dependencies takes significant time on each CI
run, especially if the dependency has C extensions that need to be
built.

This commit builds a wheel for every git dependency that has precise
reference hash in lock file and is not required to be in editable mode,
stores that wheel in a cache dir and will install from it instead of
cloning the repository again.

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

(affects `poetry add` and `poetry update`)

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

* correct logger for publisher
* build 0.10.0 to get metadata in PackageInfo
* prefer pathlib
* passwords must be strings