forc can create an invalid package dependency graph if the [dependencies] table of a path dependency manifest has been modified

[mitchmindtree]

Caught by @nfurfaro and @otrho.

Problem

Right now we only check the immediate dependencies specified in the current project's manifest when validating the graph loaded from the lock file. This means if the [dependencies] table of one of the current project's path dependencies is modified, we don't correctly catch or account for this change when loading the graph from the lock file.

Solution

When loading the graph from the Forc.lock file, we should not only validate it against the top-level project manifest, but also against the manifest of each of the path dependencies as it's possible that any of them have been modified since the Forc.lock file was created.

Note that this is not important for git dependencies where we know they haven't changed due to the hash.

Temporary Workaround

Delete the Forc.lock and re-run forc build or forc update to allow forc to rebuild the graph from scratch.