Add support for urls to PackageSpec

[Jake Shadle]

We already support an internal PackageSpec that both mimics and supports additional features than package ids, but it would be good to also support the source portion as that would allow users to disambiguate between local/private crates that happen to have the same name and/or version as a crates.io (typically) crate that matches a ban/advisory/yank/etc.