Dependencies sources

It was discussed somewhere in Gerrit but apparently was lost.

Curretly, dependency can be either a Product or a Module. Product is always used even if a module present.
This is not desirable since we need to let users to be able to choose between a built-in implementation or the system one in case of a dependent libraries. One example is Protobuf runtime - we have an ugly _linkLibraries property in order to allow user use a built-in runtime.
Also, module can either bew shipped with Qbs (or be present in a system) OR it can be generated by a provider. We have to let a user to choose between them - a shipped/system module might be broken as we see in case of the Protobuf runtime - or simply not desirable (e.g. conan provider preffered over Brew shipped module).

The proposed solution is to introduce a new list property to the Depends item, say "source" (I do remember we chose a different name to disambiguate with "package sources" back then but cannot remember it) with 3 possible values ("product", "module", "provider") which looks up the dependency in the specified order.
The default value is undefined which has the same meaning as ["product", "module", "provider"] (which reflects current behavior).
A mandatory example

CppApplication {
    Depends {name: "MyBuiltInUniqueLib" } // default, probably Product is used
    Depends {name: "zlib"; sources: "module" } // use a "system" module
    Depends {name: "Qt.core"; sources: ["provider"] } // qt provider is used
    Depends {name: "openssl"; sources: ["module", "provider"] } // system is prefered, but provider is OK too
}

We might also should be able to override props from CLI:

qbs resolve deps.zlib.sources:provider # global override
qbs resolve project.p1.deps.zlib.sources:provider # project override
qbs resolve product.p2.deps.zlib.sources:provider # product override