Not all raw revspecs should be resolved to a VCS url

[xizhao]

A release on a registry like npm is not guaranteed to be backed by any VCS nor will it always map to a VCS url. An NPM copy, for instance, should retain its revspec as an id and be considered a separate codebase, and the way to access it is just to download from a registry. Clone urls could look like npm://[email protected].

Maybe we should add a new property of a repo called release_of that, if populated, marks a repo as a fork/release of another main repo. Any package, binary, or etc. version is considered a release.

Another change that makes sense to go with this is:

toCloneURL -> clone_cmd + clone_params

git://github.com/sourcegraph/srclib.git -> { clone_cmd: `git clone`, clone_params: `github.com/sourcegraph/srclib.git` }
https://npmjs.com/owner/package -> { clone_cmd: `npm fetch`, clone_params: `owner package` }
(curl && unzip may work too for files and tars)

[xizhao]

sourcegraph/srclib-javascript#15

I think this a serious problem with how closely srclib is tied to git and resolving consistently to a vcs url. Anyone willing to pick this up with me?