depends: Move source stamps to source dir and misc cleanups

depends: Move source stamps to source dir and misc cleanups

Since the last commit will force rebuilds of all depends, take the opportunity
to clean up a few other things that would trigger rebuilds as well.

- Move source stamps to the sources dir so that SOURCES_PATH is respected for
  "make download".
- Only print "fetching..." when actually downloading a file.
- Avoid using non-deterministic paths for the recipe hash (patch location).
  This should ensure that all builders get the same resulting build-ids.
- Use a per-package source paths. This will allow for removing old source files
  in the future.
- Use a host-agnostic path for downloads which gets cleaned up properly.