Make haskellPkgDeps more robust

[Chris Warburton]

We were using Cabal 1.x sandboxes, but they seem to crash with new
Hackage indices (due to unexpected fields?).

We switched to using Cabal 2.x and new-freeze, but that doesn't seem to
take dependencies of extra sources into account. For example, panhandle
depends on lazysmallcheck2012 which isn't on Hackage; if we add it to
a 'packages:' field of cabal.local.project, its dependencies don't seem
to get frozen.

This should be reported upstream against Cabal, but first we should make
a small example to test that it is indeed the case.