adds source uri/sha fields support

[pivotal-david-osullivan]

Summary

In line with libpak#196, this change adds support for the source/sourceSha256 fields to the update-buildpack-dependency script and the workflow that invokes it.

It also contains an example of how an action (apache-tomee) outputs its custom source URI as an 'additionalOutput' which action/action.go already supports.

Use Cases

Checklist

• I have viewed, signed, and submitted the Contributor License Agreement.
• I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
• I have added an integration test, if necessary.
• I have reviewed the styleguide for guidance on my code quality.
• I'm happy with the commit history on this PR (I have rebased/squashed as needed).