Deriving dep info from fetched artifact instead of rebar.config.
Merge remote-tracking branch 'oferrigni/6_deps_discovery'

When determining the locked set of dependencies, take both the SHA and
git URL from the directories on disk in the deps dir. Previously, the
SHA was taken from the on disk directory, but the URL was determined
by the rebar.config files encountered leading to inconsistencies.