rosinstall-based implementation

not a real pull request, just inspiration to show how this could be done, even as a script in the rosinstall project.

The code misses 'push' ability, but that could circumvent all vcstools for now, using your code for calling 'scm push', until push is implemented in vcstools.

Note this changes also the following:
- vcstools does not look for cmd in $PATH (in particular not 10 times if once were sufficient)
- the code only runs the command using the first SCM it finds (as opposed to running hg pull and git pull in parallel on the same directory, ig user has both .hg and .git)
- the code does not spawn an unlimited number of threads blocking each other.

You might consider those as issues else.