Remove satisfied dependecies from next source lookup

When iterating sources and checking for met dependencies, remove the
actual specs that were satisified by the source from the lookup of
following sources.

This prevents lookup of local gems (from `gemspec` or `path` or `git`
sources) in rubygems source.

fixes #2909
If a gem can appear in both Rubygems sources and we should consider both of them, then the original bug report #2909 in which Bundler requests for a private gem from a public Rubysgems source is not a bug (though I still see an "private information leak" problem in that case; maybe we need a specific `:private=>true` mark for some gems, which will make sure we don't look for them in other Rubygems sources). Maybe we should move the discussion back to the original issue #2909 and decide what's the appropriate solution (might require new Gemfile syntax?).