check PACKAGE_FILE first, then check if MANIFEST_FILE

current implementation check if there are not exists manifest.xml then use package.xml, this means that rosdep uses manifest.xml if there exist both manifest.xml and package.xml (we mantain both manifest.xml and package.xml for backword compatibility), because current rosdep only works with newer rosdep.yaml  that usually compatible with package.xml not manifest.xml

The patch uses package.xml if exist, then try to read from manifest.xml