Graph resolve

This incorporates previous bugfixes by @alexcrichton that are still stuck in bors.
FWIW, proper hashing of `semver::Version` is in the queue: https://github.com/rust-lang/rust/pull/15564.