Download source for bundled dependency binaries for matching

In many binaries, we have bundled binaries for dependencies which are also declared in a lockfile/package-manifest.

For example in macOS there are `cartfile`/`cartfile.resolved`:

https://github.com/zhuhaow/SpechtLite/blob/master/Cartfile.resolved listing the sources/binaries for dependencies:

```
github "CocoaLumberjack/CocoaLumberjack" "3.2.0"
github "ReactiveCocoa/ReactiveCocoa" "5.0.4"
github "ReactiveCocoa/ReactiveSwift" "1.1.3"
github "antitypical/Result" "3.2.3"
github "behrang/YamlSwift" "3.4.0"
github "lexrus/MMDB-Swift" "0.2.6"
github "robbiehanson/CocoaAsyncSocket" "7.6.1"
github "sparkle-project/Sparkle" "1.14.0"
github "zhuhaow/NEKit" "0.12.1"
github "zhuhaow/Resolver" "0.1.3"
github "zhuhaow/Sodium-framework" "v1.0.10.1"
github "zhuhaow/tun2socks" "0.6.1"
```

And then in the [binary side]( https://github.com/zhuhaow/SpechtLite/releases/download/0.10.7/SpechtLite.zip#to ) we have these binaries for the dependencies bundled:

```
to/SpechtLite.app/Contents/Frameworks/CocoaLumberjack.framework/Versions/A/CocoaLumberjack
to/SpechtLite.app/Contents/Frameworks/ReactiveCocoa.framework/Versions/A/ReactiveCocoa
to/SpechtLite.app/Contents/Frameworks/ReactiveSwift.framework/Versions/A/ReactiveSwift
to/SpechtLite.app/Contents/Frameworks/Result.framework/Versions/A/Result
to/SpechtLite.app/Contents/Frameworks/Yaml.framework/Versions/A/Yaml
to/SpechtLite.app/Contents/Frameworks/MMDB.framework/Versions/A/MMDB
to/SpechtLite.app/Contents/Frameworks/CocoaAsyncSocket.framework/Versions/A/CocoaAsyncSocket
to/SpechtLite.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle
to/SpechtLite.app/Contents/Frameworks/NEKit.framework/Versions/A/NEKit
to/SpechtLite.app/Contents/Frameworks/Resolver.framework/Versions/A/Resolver
to/SpechtLite.app/Contents/Frameworks/Sodium.framework/Versions/A/Sodium
to/SpechtLite.app/Contents/Frameworks/tun2socks.framework/Versions/A/tun2socks
```

To enhance the pipeline, we could download the sources for these and match with the binaries here.