Allow tags or urls as dependencies

The requirement that they be semver ranges is too strict.  Since tags
can be any arbitrary string, we have to allow any arbitrary string.