Order of sources as a potential security issue

Description

According to #1404, paket does not prioritize feeds in the order they are defined, rather, the first source to respond is given priority. Our organization keeps a private repository for internal packages, and most of our projects pull on a mix of internal and external nuget packages. We are concerned that this behavior (arbitrary feed priority) could be a potential security threat, with an attack such as the following:

1. Malicious actor learns the name of an internal package id through some means (disgruntled employee, educated guessing, social engineering).

2. Actor crafts a malicious package with an identical id, but higher version than whatever we have internally, and publishes this package to NuGet gallery

3. Paket then fetches this package, because nuget.org answered faster, and we end up with malicious code being executed on internal servers.

Potential mitigation

We believe that a true fix for this would be to have paket prioritize sources in the order they are defined. However, as a potential mitigation strategy, perhaps we could add an optional priority keyword to source entries, that would work similar to apt's Pin-Priority option. Ie, each feed would, by default, have some arbitrary priority value (say 50), and users could override this value with a lower or higher priority in this manner:

source https://www.nuget.org/api/v2 priority: 10

Start by reading issue #1404 and tracing how Paket handles multiple NuGet sources, including the source syntax shown here. Compare the defined source order with the first-response behavior, then clarify whether ordered resolution or a priority option is the intended scope. Done means the mixed internal and external feed security concern has an agreed and implemented resolution.