fix: don't allow the root package dependencies to be overwritten in the map
fix: don't allow the root package dependencies to be overwritten in the map

The rewrite map is built recursively scanning the root package dependencies. If
two packages in the tree imported the same dependency with different hash the
last one to be processed would overwrite the first one.

Include a flag in `buildRewriteMapping` to signal when the root package
dependencies are being process and allow them to overwrite the map (adding an
overwrite flag in `addRewriteForDep`) but don't allow the inverse (transitive
dependencies overwriting direct ones).

This change has as a side effect that in a scenario where transitive
dependencies with different versions were overwriting each other that won't be
allowed now, changing in fact the rewrite map, but that would happen only in the
already problematic scenario of dependencies with mismatched versions.

whyrusleeping/gx-go