Avoid installing URL dependencies multiple times.

Use the _resolved property from installed packages to avoid installing
URL dependencies after they are already installed. Also ensure that you
can still use --force if the packages have really changed

This also fixes #3463 as shrinkwrapped dependencies are basically
treated the same as tarball dependencies.