repositories: new class LockfileRepository that can distinguish direct origin dependencies with same name and version
