GitHub dependency graph integration should indicate the source of the dependencies

[michaelbprice]

The input provided to the dependency graph submission API should properly indicate the source of the reported dependency.

For dependencies listed in the manifest file, the repository-relative path to the manifest file should be provided.

For dependencies installed via "classic" mode, there workflow file (or if possible/necessary, script or data file) should be provided.

Transitive dependencies should have a source location that corresponds with the dependency that caused them to be included.