Hackage accepts `.cabal` files with 2 `source-repository head` entries

E.g. this one: https://hackage.haskell.org/package/pipes-zlib-0.4.4.2/pipes-zlib.cabal
```
source-repository head
type: git
location: https://github.com/k0001/pipes-zlib.git

...lots of stuff...

source-repository head
type: git
location: https://github.com/githubuser/twio
```
When you do `cabal get -s pipes-zlib` you see no error either, it somehow decides on one of these sources.
(Likely on the first one, because the second does not exist.)

I can see how this could maybe be exploited, tricking developers to download and run malicious code, by sneaking in an evil `source-repository` stanza that is overlooked. (E.g. by a malicious hackage trustee or co-uploader.)

`hackage-server` should not rely on `cabal check` or `sdist` catching this but refute such packages.

One wonders how such bugs arise in the first place, likely by violation of the _parse don't validate_ principle.