Add logic to disallow import cycles

[sdboyer]

There's a spot just waiting to do it in the checkProject() and checkPackage() methods.

For now, it's probably fine to use an offline algorithm (e.g., Tarjan SCC) to find cycles. That gives us linear time in the number of packages and dependencies. Brief searches suggest that there's probably a sublinear incremental cycle discovery algorithm out there that we can swap in later.

[fabulous-gopher]

This issue was moved to golang/dep#439