Manage the lifecycle of dependencies using annotations

[qzb]

New registry format supports annotating dependencies (and whole registry as well). We can use this feature to provide better prompts about updates. I don't know yet how this annotations should look, but I have few ideas for how they could be used:

• Prevent installing obsolete or experimental versions (unless forced?)
• Point to release notes when prompting about new major versions
• Display warnings about using deprecated or obsolete version of a command
• Display info about new URL for the registry
• Point to another command which replaces current one

I'm not sure if we want all of these to be implemented, let me know what do you think.

[gpolek]

I don't know if this 'Display info about new URL for the registry' is required for a start, as we only start with klio and change of registry url is not that common, and most of the users just don't care about where the registry actually is.

Even if registry url changes, redirect should allow klio to follow to a new location.

The rest is OK.

[qzb]

@gpolek I think you are right about the registry, proper support for 301 redirects seems to be a much better idea, since it could actually result in changing urls in dependencies.json and g2a.yaml file.

About the rest, what do you think about these annotations:

• dependency.klio.sh/state - one of: obsolete, deprecated, experimental or stable (default).
• dependency.klio.sh/release-notes - url to changelog, blog post, GitHub release, etc.
• dependency.klio.sh/replaced-by - object with name, registry and version (only name is required).

[gpolek]

What the difference between obsolete and deprecated values of dependency.klio.sh/state? (the rest is clear)

Annotations keys look fine.

[qzb]

In our case, I think it would work like this:

• deprecated ﹣version is no longer recommended to use, but it still works (klio would install it, but show warning)
• obsolete ﹣version is no longer usable (klio has to be forced to install it)

If you don't think we need this distinction, we can drop "obsolete".