fix inconsistent vendor package behaviour

when we introduced the prefixed vendored package behaviour we overlooked
a case that could lead to inconstistent writes of the spec.lock for a
prefixed package.

The issue was described in #606

The underlying cause was the ordering of `allInterestingPkgs`
https://github.com/cloudfoundry/bosh-cli/pull/603/files#diff-420d09437c4bf08b4407d39b5956c6209df3519cde36b121a856085e372d2c92R240-R241

As setup in the added test, we have 3 packages. The top level package
`pkg-1` and the two dependencies it pulls in `pkg-2,pkg-3`

The ordering of the map `allInterestingPkgs` is inconsistent and the
test will fail for every case where pkg-1 isn't the last item in
`allInterestingPkgs`. That is because we end up calling
writeVendoredPackage on pkg-1, which in turn will iterate over the
dependencies.

At this point we didn't yet call .Prefix and .Finalize on the objects
for `pkg-2` and `pkg-3`. Though this is required so they can return
their prefixed name via Name().

This is addressed by duplicating the loop. The first pass will ensure
all objects in the dependency tree are prefixed and finalized before
the spec.lock is written to disk.

releasedir/fs_release_dir.go

@@ -247,8 +247,10 @@ func (d FSReleaseDir) VendorPackage(pkg *boshpkg.Package, prefix string) error {
 		if err != nil {
 			return bosherr.WrapErrorf(err, "Finalizing vendored package")
 		}
+	}
 
-		err = d.writeVendoredPackage(pkg2)
+	for pkg2 := range allInterestingPkgs {
+		err := d.writeVendoredPackage(pkg2)
 		if err != nil {
 			return bosherr.WrapErrorf(err, "Writing vendored package")
 		}

releasedir/fs_release_dir_test.go

@@ -708,6 +708,32 @@ fingerprint: pkg4-fp
 			Expect(pkg4Res.FinalizeArgsForCall(0) == finalIndicies.Packages).To(BeTrue())
 		})
 
+		It("reliably vendors packages with prefix inlcuding their dependencies", func() {
+			_, err := fs.ReadFileString("/dir/packages/prefixed-pkg1-name/spec.lock")
+
+			Expect(err).To(HaveOccurred())
+			pkg2Res := resource.NewResourceWithBuiltArchive("pkg2-name", "pkg2-fp", "/test/something", "something")
+			pkg3Res := resource.NewResourceWithBuiltArchive("pkg3-name", "pkg3-fp", "/test/something", "something")
+			pkg2 := boshpkg.NewPackage(pkg2Res, []string{})
+			pkg3 := boshpkg.NewPackage(pkg3Res, []string{})
+
+			pkg1Res := resource.NewResourceWithBuiltArchive("pkg1-name", "pkg1-fp", "/test/something", "something")
+			pkg1 := boshpkg.NewPackage(pkg1Res, []string{"pkg2-name", "pkg3-name"})
+
+			err = pkg1.AttachDependencies([]*boshpkg.Package{pkg2, pkg3})
+			Expect(err).ToNot(HaveOccurred())
+
+			err = releaseDir.VendorPackage(pkg1, "prefixed")
+			Expect(err).ToNot(HaveOccurred())
+
+			Expect(fs.ReadFileString("/dir/packages/prefixed-pkg1-name/spec.lock")).To(Equal(`name: prefixed-pkg1-name
+fingerprint: pkg1-fp
+dependencies:
+- prefixed-pkg2-name
+- prefixed-pkg3-name
+`))
+		})
+
 		It("finalize given package with prefix", func() {
 			pkg1Res := resource.NewResourceWithBuiltArchive("pkg1-name", "pkg1-fp", "/test/something", "something")
 			pkg1 := boshpkg.NewPackage(pkg1Res, nil)