support repository names with commas

[aronatkins]

This change adds repository name support to lockfile parsing without
introducing quoting or escaping. It assumes that URLs may be part of repository
names but are unlikely to occur in repository URLs.

This means that a repository value of:

A=B,C,D=E

is interpreted as:

A=B
"C,D"=E

We will need to introduce quoting / escaping if we encounter commas in URLs as
well as repository names.

fixes #587