do not assume CRAN for packages without Repository information

A CRAN-like repository may not annotate DESCRIPTION records with the Repository field. Packrat incorrectly assumes that these packages are from CRAN.

https://github.com/rstudio/packrat/blob/29a4fdcb5d34113222b73e4eb2affd0e3fc3f1fd/R/pkg.R#L114-L124

This code produces warnings of the form:

1: In FUN(X[[i]], ...) : 
Package 'MYPACKAGE 0.2-7.5' was installed from sources; Packrat will assume this package is available from a CRAN-like repository during future restores 

This warning is presented without searching for the package in the set of available.packages. Given the contrib.url in available.packages, packrat could determine the name of the repository as specified in the repos option.

The fallback code here is using available.packages but assuming that all packages in this set are CRAN packages:

https://github.com/rstudio/packrat/blob/29a4fdcb5d34113222b73e4eb2affd0e3fc3f1fd/R/pkg.R#L126-L144

The rsconnect package does a variation of this renaming here:
https://github.com/rstudio/rsconnect/blob/90bf6cde2bf6f12484fd89d866363d4b78cc483d/R/dependencies.R#L106-L123
The rsconnect code does not rename the repository record when packrat indicates the package comes from CRAN (because CRAN is a well-known name).

The packrat package analysis probably doesn't need to be as conservative as rsconnect. Maybe:

1. preserve Repository: CRAN in DESCRIPTION.
2. preserve repos = c(CRAN = cranURL) as CRAN.
3. attempt to discover the true repository for any package without Repository in DESCRIPTION.

Start in R/pkg.R at lines 114-144 and trace how DESCRIPTION and available.packages determine a package repository. Compare the related logic in rsconnect's R/dependencies.R lines 106-123, then establish behavior for missing Repository fields, CRAN entries, and alternate repos without assuming every available package is from CRAN.