Add support for package version pinning

[jan-kiszka]

The user should be able to retrieve a list of packages and their exact versions that Isar installed in an image. With that list, it should then be possible to regenerate the very same image later on.

This also means we will need repository servers that preserver all those packages, even if normal mirrors dropped them with the availability of newer versions.

[smk-embedded]

Would it make more sense, in terms of the Unix philosophy, to use another tool for the job, instead of reinventing the wheel. E.g. aptly could be used in conjunction with Isar. Or do I miss a problem here?

[jan-kiszka]

We are considering aptly. Claudius is right now looking into details.
If you are interesting in detailed discussions, please follow up on this on the mailing list. Issues here are more like to-do lists.