depends: Move source stamps to source dir and misc cleanups

Since the last commit will force rebuilds of all depends, take the opportunity
to clean up a few other things that would trigger rebuilds as well.

• Move source stamps to the sources dir so that SOURCES_PATH is respected for "make download".
• Only print "fetching..." when actually downloading a file.
• Avoid using non-deterministic paths for the recipe hash (patch location). This should ensure that all builders get the same resulting build-ids.
• Use a per-package source paths. This will allow for removing old source files in the future.
• Use a host-agnostic path for downloads which gets cleaned up properly.