Minimal rebuilds for add-source dependencies

Fixes #1121.

Implemented by remembering timestamps for all add-source dependencies in a timestamp file, `.cabal-sandbox/add-source-timestamps`. `reinstallAddSourceDeps` now looks at the timestamp file record and the timestamps of the source files of a given add-source dependency to decide whether it is to be reinstalled. The timestamp record is first added by `sandbox add-source` and can later be updated/removed by `reinstallAddSourceDeps`/`sandbox delete-source`. User is allowed to (re)install add-source deps manually with `cabal install [--reinstall]`, so this scheme sometimes errs on the side of caution.

In the future I'd like to get rid of the timestamp file and just keep that info in the index (so that there is less chance that it goes out of sync).