Base get_fingerprint on a PackageId

The fingerprinting code was erroneously using all sources from a manifest when
calculating the fingerprint which meant that sources not yet downloaded were
attempted to be fingerprinted.

The correct source to fingerprint is located in the SourceId field of the
resolved PackageId.

Closes #259
`example.com` is actually documented in the relevant RFC as being the correct domains to use for illustration/demonstration: http://www.iana.org/domains/reserved

While this use-case here doesn't fit into that precisely, it seems kinda bad to be "hammering" random other domains.