Pull neo-io and neo-http
fix: failbit will cause exceptions on EOF

This is a large changeset that changes the way we store package
remote info. In these changes, package remotes are entirely
encoded in a single URL. This will help reduce complexity
down the road when multiple different remote types are supported.

The kind of a remote is specified by the URL's scheme, and the
URL parsing differs based on the scheme. For now, only git+http
and git+https are supported.

This comes along with a change to the format of the catalog JSON.
Remote information is now entirely encoded in a URL string.