Support unnamed requirements in --require-hashes (#2993)

## Summary

This PR enables `--require-hashes` with unnamed requirements. The key
change is that `PackageId` becomes `VersionId` (since it refers to a
package at a specific version), and the new `PackageId` consists of
_either_ a package name _or_ a URL. The hashes are keyed by `PackageId`,
so we can generate the `RequiredHashes` before we have names for all
packages, and enforce them throughout.

Closes #2979.

crates/uv-resolver/src/resolver/batch_prefetch.rs

@@ -141,7 +141,7 @@ impl BatchPrefetcher {
                 dist
             );
             prefetch_count += 1;
-            if index.distributions.register(candidate.package_id()) {
+            if index.distributions.register(candidate.version_id()) {
                 let request = match dist {
                     ResolvedDistRef::Installable(dist) => Request::Dist(dist.clone()),
                     ResolvedDistRef::Installed(dist) => Request::Installed(dist.clone()),