Resolve package version conflicts when served from multiple paths

[mtojek]

The EPR supports multiple paths for packages. It may happen that two package, tagged with the same version, but with different content (e.g. integrations developer modified one of them to check a bugfix).

The goal of this task is to plan what is the expected behavior for EPR, e.g. warn/ignore package conflicts or first found served.

Then, implement it.

[ruflin]

With elastic/package-storage#86 in mind, my proposal is that we go with first found, first served. Lets assume package foo:2.1.3 exists in production and snapshot. The one in production should be served as it was released and the one in snapshot should have a higher version number.

If we want to go one step further, we are going through all packages on startup for validation. There we could log a notice if we find the same version twice.

[ruflin]

@mtojek Closing this as I think you implemented this.