RFE: support URLs to rpms in manifest.json files

[dustymabe]

similar to #1508 it would be nice if we could just list a URL to an RPM inside a manifest file and have that be picked up during rpm-ostree compose tree. If we do a koji scratch build or something this would skip a few steps: having to download the rpm, make a local repo etc.

related: coreos/coreos-assembler#118

[jlebon]

Sounds neat. We'd have to make sure to (1) smartly cache the RPMs (and e.g. use If-Modified-Since), and (2) still respect idempotency if the pkg didn't change.

[dustymabe]

mike has volunteered to work on this to learn more of the ostree/rpm-ostree code bases.

[mike-nguyen]

Sorry it took a while to get up to speed. There's so many different parts to the compose but I think I've finally got to a point where I can actually work on this card instead of just tinkering with the code. Before I dive headfirst, @jlebon--do you have any thoughts into the addition of the URLs? Is it better to allow URLs in the packages list in the manifest or create a new list for URLs?

[jlebon]

Offhand, I think supporting it directly in the packages list would be OK? Just random thoughts on this:
one way to implement this would be to download all the pkgs to a new dir in the cache dir. And then respect the same semantics as rpm-md repos, i.e. --cache-only won't retry fetching then, while without --cache-only, we refetch (though a nice follow-up would be to only refetch if it changed).