Complete the dependency_source type with MultiLockfile (#351)

The goal is to remove the redundancy between the type defs
in the .atd and in subproject.py (which will help migrate
the code from subproject.py to a new Subproject.ml)

test plan:
see related PR in semgrep


- [x] I ran `make setup && make` to update the generated code after
editing a `.atd` file (TODO: have a CI check)
- [x] I made sure we're still backward compatible with old versions of
the CLI.
For example, the Semgrep backend need to still be able to *consume* data
	  generated by Semgrep 1.50.0.
See
https://atd.readthedocs.io/en/latest/atdgen-tutorial.html#smooth-protocol-upgrades
	  Note that the types related to the semgrep-core JSON output or the
	  semgrep-core RPC do not need to be backward compatible!

semgrep_output_v1.atd

@@ -2239,13 +2239,26 @@ type lockfile
     path: fpath;
 }
 
+(* TODO? use a record instead of an ADT? *)
 type dependency_source
     <ocaml attr="deriving show">
     <python decorator="dataclass(frozen=True)"> =
 [
   | ManifestOnlyDependencySource of manifest
   | LockfileOnlyDependencySource of lockfile
   | ManifestLockfileDependencySource of (manifest * lockfile)
+  (* The dependency_source should be LockfileOnly or ManifestLockfile,
+   * but not ManifestOnlyDependencySource.
+   * Right now this variant is only used by pysemgrep; it is
+   * deconstructed in multiple LockfileXxx when calling the dynamic resolver.
+   * Note that this variant introduces a series of problems in the Python code
+   * because atdpy generates a List[DependencySource] and List are
+   * not hashable in Python. We had to define a special hash function
+   * for Subproject to avoid hashing the dependency_source.
+   * TODO? add a <python repr="tuple"> so the list is converted instead in a
+   * Tuple[DependencySource, ...] which is hashable.
+   *)
+  | MultiLockfileDependencySource of dependency_source list
 ] <ocaml repr="classic">
 
 (* alt: sca_error_kind *)