provider: do not merge deps from different sources

This change ensures that the provider is less eager when merging
duplicate dependencies for a package. In particular, takes into
consideration source type, url and reference if available.