Release v0.4.0

* BREAKING API CHANGES

- ContentProvider trait now includes `fetch_git_repo(&GitRepo)` and
 `materialize_git_paths(&MaterializedGitRepo, &[PathBuf])`.
 `transport()` has been removed.
- Manifest::from_file now requires `&C: ContentProvider` to resolve
  git imports.
- Init command `--import` field type changes from `Option<PathBuf>`
  to `Option<String>` to accept git URLs.
- Init and ArchiveAdd commands now explicitly require `--suite`
  unless archive URI is a vendor name, in that case the vendor
  default suits are used.

* feat: support Debian flat-repository archives

Add first-class support for Debian flat repositories
(`sources.list(5)` "flat repository format"), where Release / Packages /
Sources files live directly inside a suite directory rather than under
a `dists/<suite>/<component>/` hierarchy. Thanks to NVidia for
an unexpected example.

Release v0.3.6

feat: Allow specs to extend multiple parents; inheritance remains
 strictly additive. This was the initial design, it does not make
 much sense for the rdebootstrap, but is essential for deb-ostree.

Release v0.3.5

* fix: the local .deb should have an absolute precedence over archives
* fix: use File artifact hash for spec hash
* chore: cargo update

Release v0.3.4

* fix: debrepo deb::DebReader supports lz4
* fix: debrepo deb::DebReader limit the max size of gpg signature by 1MiB.

Release v0.3.3

* fix: debrepo deb::DebReader support for POSIX/SysV ar format
* feat: debrepo deb::DebReader support for in-package signatures
  (no verification yet)

Release v0.3.2

* feat: cli spec extend command
* feat: cli http timeout option
* chore: cargo update (note digest 0.10 -> 0.11)
* chore: release 0.3.2

Release v0.3.1

* fix: use artifact hashing function to calculate spec hash

Release v0.3.0

* BREAKING CHANGE: the solver now enforces that a child spec
  cannot drop packages locked by a parent spec. This change
  allows to enable incremental builds in deb-ostree.
* BREAKING CHANGE: major and long deserved Manifest API overhaul.
  Move most of spec-querying methods into a first-class
  ResolvedSpecRef type. Simplify and de-duplicate Manifest API.
* BREAKING CHANGE: add lock file format versioning.
* BREAKING CHANGE: more consistent spec hashing scheme.
* feat: enable incremental staging (for deb-ostree, not used
  in rdebootstrap).
* fix: detect and reject duplicate packages with different hashes
  during universe construction.
* fix: rewrite the installation order to algorithm to distinguish
  Pre-Depends from Depends and to provide better batching.
* chore: temporarily disable Ubuntu packages builds due to
  failing snapshot.ubuntu.com.
* chore: new release.

First release with API freeze, version 0.3 would mean API changes.

* change: do not stage apt-lists by default to avoid updates when mirror

  indexes drift.
* feat: --snapshot today. Using "now" is problematic because Debian and
  Ubuntu snapshot services are eventually consistent; index files downloaded
  at "now" may later drift.
* fix: add more comprehensive unit tests to improve coverage and robustness