Explicit sources are considered only for packages that explicitly indicate their source.

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

sources: introduce "priority" key for sources and deprecate flags "default" and "secondary", adjust cli accordingly (#7658)

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

Currently, poetry install will clone, build and install every git
dependency when it's not present in the environment. This is OK for
developer's machines, but not OK for CI - there environment is always
fresh, and installing git dependencies takes significant time on each CI
run, especially if the dependency has C extensions that need to be
built.

This commit builds a wheel for every git dependency that has precise
reference hash in lock file and is not required to be in editable mode,
stores that wheel in a cache dir and will install from it instead of
cloning the repository again.

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

(affects `poetry add` and `poetry update`)

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

* correct logger for publisher
* build 0.10.0 to get metadata in PackageInfo
* prefer pathlib
* passwords must be strings

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>

Co-authored-by: Randy Döring <30527984+radoering@users.noreply.github.com>