[Feature] rocks sync command

[mrcjkb]

• Use the rocks.lock as the source of truth to sync rocks in a given tree.
• Fail if there is no lockfile.
• Fail if there are rockspec or source integrity mismatches
  • Should have an option to only warn on failed integrity checks (to handle force-uploaded scm rockspecs).

[mrcjkb]

I think we should change hashes.source in the lockfile to an Option and only set it if the source in the rockspec is something that is unlikely to change (tag, although tags aren't always immutable, commit sha, non-scm URL, ...).
Perhaps we should never set it for dev versions. 🤔

[mrcjkb]

To make sure rocks sync can be used by nixpkgs, we should not try to fetch the luarocks manifest. Instead, we should construct a RemotePackageDB from the lockfile.
This means we need to include the source URL for each RemotePackage in the lockfile.

🤔 Unfortunately, lockfiles that have binary rocks in them won't be cross-platform.