rearrange specs
Search remote gem servers in reverse.

This reverts to the documented behavior
(http://bundler.io/v1.6/man/gemfile.5.html#SOURCE-PRIORITY) that
regressed in v1.5.0.
try to de-dupe rubygems remotes
Restore original Rubygems sources after fetching.
Detect ambiguous gems.
Encapsulate Definition#sources.
Extract SourceList class from Definition.
raise errors from option validator
Extract source URL normalization to a new method.
Separate Rubygems sources into multiple objects.

with @TimMoore and @ckrailo
lockfile source parity

the lockfile parser was creating and then providing a single rubygems
source, with multiple remotes. that doesn't work now that we have
multiple remotes, so I updated it to create source objects for all
of the remotes that are in the lockfile.

this doesn't solve the problem of source affinity at all, and at best
just punts on it, but we definitely need the lockfile parser to return
multiple rubygems sources instead of just one.
allow rubygem sources via block or :source option
Add tests for indirect dependencies.
Don't warn on system gems.
Add a spec for gems not in the pinned source.
Update Gemfile man page with new source options.
Add 1-7-stable branch to .travis.yml.
Version 1.7.0 with changelog
Fix handling for sources with basic auth.

Closes #3132.
Merge pull request #3137 from TimMoore/1-7-stable

Fix handling for sources with basic auth