Describe the underlying sources for merged metadata

Background

Support and customers need to be able to understand what metadata was merged to produce group-level merged metadata files. For instance, when a maven-metadata.xml is fetched from a group, it's actually the product of metadata from a number of underlying repos. Which ones?

Acceptance

• For cached, merged metadata artifacts (e.g. maven-metadata.xml) there should be some way to tell which underlying metadata files were merged to produce this output.
• This should be visible in the extended attributes
• This should be visible in the ?describe page when requesting the merged metadata
• The order of precedence should be clear

Questions

Can this work for all formats?

• Nuget ODATA: No. (Perhaps not relevant?)
• Docker? (please refine)
• npm (please refine)
• RubyGems (please refine)
• Others? (please refine)

How do we identify the underlying files? Is Repo + path enough? Should we also add a timestamp of some sort, so users can potentially detect