Redundant registry update when adding a dependency to several worksapace members

[matklad]

I have a workspace with two packages, one of which depends on regex="*". If I add regex="*" to the second member as well, I hit a registry update on the next rebuild. It is not necessary, because the existing regex dependency of the workspace will be reused.

I think the general property we want is:

• If after an update the lock file contains the subset of the packages before the update, then we have not hit the Internet.

[matklad]

May or may not be relevant, but updated field of the RegistrySource is never used (always false).

[alexcrichton]

I think this is a dupe of #2895, so closing in favor of that. Agreed a bug though!