Specify Dependency Source

Description of the new feature / enhancement

• Related to #3271

In an enterprise setting, or a setting where custom sources are in play, there is a possibility that Package Identifiers will conflict. Currently, the way to definitively identify a package is through the Source-Identifier pair.

To ensure conflicts are avoided in an enterprise scenario, it should be possible to specify the source to use for a package.
Alternatively, sources to not use could also be specified.

Proposed technical implementation details

There is a complication here that sources can have almost any name. Additional thought may need to be given around how to specify the source details like the type and URL as part of the dependency.

This may also necessitate the need to define a new type of dependency -

Dependencies:
  Sources:
    - <Source Information>

Start by reading related issue #3271 and tracing how package identifiers and dependency sources are represented in the winget-cli codebase. Define the dependency syntax and source type/URL handling, including whether sources can be included or excluded; the work is done when conflicting package identifiers can be disambiguated in enterprise and custom-source scenarios.