The source used to download a particular package still isn't
deterministic in nuget. Even worse, the hash of the package can vary
between sources. This makes nuget use the first enabled source
containing the package.
The order of the dependencies may be slightly different because it now
uses glob order of the lower-case package names and versions, instead of
sorting the output.
If the package actually downloaded was the first source that contains
the package, then it will be hashed from disk to avoid downloading it
again.
In some cases `$pkgs_src` can be a path. For example with `FSharp.Core` when it comes with dotnet SDK.
In these cases we need to fallback on default URL otherwise curl fails.
If the package was not restored from nuget.org (determinted by checking
the "source" field of ".nupkg.metadata"), query the custom source for
the package endpoint (the way nuget api is built we can't determine it
without an API query) and build a custom package URL to save in the
generated deps file.
It is the package list output that should be sorted. The current
output sequence is not logical because '.' is sorted in front of '/'
with input sorting and is not deterministic for different language
environments.
To get a deterministic and logical sorting in environments with
different language configured, env "LC_ALL=C" is set and the produced
strings is that is sorted. To get alphabetic sorting and not a pure
ASCII value sort "--ignore-case" is added.
