Consider broken commits on package source main branches

When rebuilding transitive dependents, we currently build the latest commit on package source repositories' main branch. Due to various reasons, that commit might be broken and unfit for release. We should consider taking the latest released commit in the target repository instead.