Support local (unpublished) package deps

[cgay]

It shouldn't be necessary to publish a package in the public catalog in order to use it as a dependency. An organization might want to develop a suite of internal packages, for example.

Git submodules could be used to accomplish this, but then you'd be using git submodules, and nobody wants that. Also they wouldn't participate in dependency resolution.

Not sure how I want to handle this yet. Support multiple catalogs with precedence order probably?