Currently, a ResolvedDist does not always have a hash. This is a problem for the lock file where we'd ideally want hashes for at least direct URL dependencies. We currently also don't have hashes for Git or Path dependencies, but I think we probably don't want those. (Cargo doesn't use hashes for that case either.)

So I think we need to fix this:

And this:

And then probably update the data structures so that hash isn't required for the git and path sources.