Use https git URL.
We need to distinguish by key, not full id.

It's possible that two versions of the same artifact are "equidistant" from the
root POM, in which case we need to pick the lexically first one, rather than
letting them both slip into our dependency list.