On one code path, they were handled as numbers, whereas elsewhere they were
handled as strings. This led to the package-metadata code trying to insert
duplicate entries.
Instead, just handle them as strings everywhere.
Store the location a package can be found at, and display this on the package
page.
If available, link off to the git repository containing the package.
I'm thinking about adding more fields to this table, and the sha1_hash values
will make this tricker.
Therefore, remove the value, and adjust the existing code to cope. This commit
also adds a new test which coveres some of the changed functionality.
