Combine static analysis with pure manifest declarations to constitute depgraph #35

This one's been a long time coming, and is, I think, the last major hurdle.

At present, we only look at the dependencies declared by a manifest when determining what actual dependencies are needed. This has three obvious problems:

• There may be deps needed by the source that are not expressed in the manifest
• There may be deps expressed by the manifest that are not in the source
• There may be deps where some of their packages are needed by the dependee, but not all, and some of the unneeded packages may induce additional, unneeded deps

I'm not necessarily completely clear on the correct final answer to all of these questions, but it is clear that to begin answering them, we absolutely have to start including static reachability analysis in the solver itself.