Being able to explicitly specify package repository namespaces

_Note: This is an effort to finish the work that was started with the [Provenance-Qualified Package Imports](https://github.com/gbaz/ghc-proposals/blob/patch-1/proposals/0000-provenance-qualified-imports.rst#id3) GHC proposal_

Scenario: I am a user in a corporate environment and I wish to rely on packages across several package repositories: Hackage Central, a privately-hosted package repository, and a public third-party repository. As it happens, the package names are not unique across the repositories, because internal forks have happened.

## Repository marker

I would like to be able to specify the package repository where a dependency belong so that its origin is made crystal clear from only reading the cabal file. Example:

```cabal
, @hackage/regex-tdfa
, @hackage/resource-pool
, @hackagesandi
, @hackage/scientific
, @mycompany/commons
, @mycompany/prelude
, @mycompany/servant
, @cardano/goblins
, servant-auth
, servant-blaze
```

Here we have four elements:

1. `@hackage` is explicitly referring to the Hackage Central server
2. `@mycompany` is explicitly referring to my company's privately hosted package repo
3. `@cardano` is a publicly available package repository based on Cardano's [Foliage](https://input-output-hk.github.io/cardano-haskell-packages/) setup.
4. unqualified packages are implicitly referring to Hackage Central.

The '@' syntax is take from package repositories like NPM ([@purescript/node-fs](https://www.npmjs.com/package/@purescript/node-fs)).
Today, the [Flora](https://flora.pm/) meta-index already supports the namespacing of Hackage packages like [@hackage/base-orphans](https://flora.pm/packages/@hackage/base-orphans).

## Isolation

Hackage Central normally operates under a "closed world" assumption (with the notable exception of packages later removed because they were fraudulent), and it is desirable to maintain this constraint. As the GHC Proposal linked above suggest, it should unequivocally reject packages that make use of this feature.

Regarding third-party repositories, I am of the initial opinion that they could allow packages that refer to other third-party repositories, and the packages themselves would document the configuration procedure to add new package repositories.

## Configuration

There are two aspects to consider:

1. Local & Global cabal configuration of these package repositories: A stanza in `$XDG_CONFIG_HOME/cabal/config` and/or `cabal.project` that would declare the configured package repositories:

```
source-origin-aliases:
hackage: https://hackage.haskell.org
cardano: https://input-output-hk.github.io/cardano-haskell-packages/
mycompany: https://internal.mycompany.corp/packages
```

2. Declaring in the .cabal file that third-party repositories are used, in order to give the option to the hosting repository to reject a package whose dependencies would not be entirely self-contained (or depending on that exact third-party repository + Hackage Central)

---

I am certainly missing some crucial elements here, and I'd be happy to consolidate this ticket based on your inputs. :slightly_smiling_face:

cc @gbaz @andreabedini

Start with the linked Provenance-Qualified Package Imports GHC proposal, then review the proposed source-origin-aliases configuration in cabal config, cabal.project, and project.cabal files. Define the accepted namespace syntax, repository configuration, and isolation rules; done means the behavior and compatibility requirements are agreed and documented well enough to implement.

Written by the indexing model from the issue text.