If SourceLink is used, the RepositoryUrl will be initialized from the PrivateRepositoryUrl (as long as PublishRepositoryUrl=true). This URL should also be the default for PackageProjectUrl since it's quite common for OSS projects to not have a separate site.

NOTE: neither value is defaulted to the URL unless PublishRepositoryUrl=true, so it's an explicit opt-in, to avoid leaking internal URLs