auto merge of #965 : alexcrichton/cargo/issue-951, r=brson

When applying the lockfile to a resolve graph, we need to take into account that
the listed source of dependencies can change over time, in which case we cannot
lock to the previous version but instead need to continue onwards with updating
the listed source.

Closes #951