Add sources to override sources fetcher

[juliens]

This PR is a proposition to be able to override the source fetcher.

This can collide with #42 but I think it's a simpler solution to the problem.

User needs to define by itself how to fetch the dependency, but with that it works with all repository etc.. (no guessing).

The usage is pretty simple:

pkgs.buildGoApplication {
  pname = "my-app";
  version = "0.1";
  pwd = ./.;
  src = ./.;
  modules = ./gomod2nix.toml;
  sources = {
    "my-dependency_v0.10.0"= builtins.fetchGit {
      url = "[email protected]:test/my-dependency.git";
      ref = "master";
      rev = "xxxxxxxxx";
    };
  };
}

I just wonder if it is a problem that we don't verify the origin sha of the dependency and that we move the responsability of the "sha" on the fetchGit

WDYT?

[frederictobiasc]

Hi, this works for my private repositories. Would also be interested in knowing what the maintainers think of this solution.

[anthr76]

It would be nice to have support to pass in packages of private go modules so they can be easily re-used between derivations.