We were seeing these failures in the nightly builds:

```
FAILED tests/test_arcs.py::LoopArcTest::test_continue - AssertionError:
  Possible arcs differ: minus is expected, plus is actual
    (-1, 1) # .1
    (1, 2) # 12
    (1, 5) # 15
    (2, 3) # 23
    (3, 1) # 31
  - (4, 1) # 41
    (5, -1) # 5.

  Missing arcs differ: minus is expected, plus is actual
  - (4, 1) # 41
  +

assert False
FAILED tests/test_arcs.py::LoopArcTest::test_break - AssertionError:
  Possible arcs differ: minus is expected, plus is actual
    (-1, 1) # .1
    (1, 2) # 12
    (1, 5) # 15
    (2, 3) # 23
    (3, 5) # 35
  - (4, 1) # 41
    (5, -1) # 5.

  Missing arcs differ: minus is expected, plus is actual
    (1, 5) # 15
  - (4, 1) # 41

assert False
FAILED tests/test_arcs.py::ExceptionArcTest::test_raise_followed_by_statement - AssertionError:
  Possible arcs differ: minus is expected, plus is actual
    (-1, 1) # .1
    (1, 2) # 12
    (2, 3) # 23
    (3, 4) # 34
    (4, 6) # 46
  - (5, 8) # 58
    (6, 7) # 67
    (7, 8) # 78
    (8, -1) # 8.

  Missing arcs differ: minus is expected, plus is actual
  - (5, 8) # 58
  +

assert False
FAILED tests/test_coverage.py::SimpleStatementTest::test_raise_followed_by_statement - AssertionError: [1, 2, 4, 5] != [1, 2, 3, 4, 5]
assert [1, 2, 4, 5] == [1, 2, 3, 4, 5]
  At index 2 diff: 4 != 3
  Right contains one more item: 5
  Full diff:
  - [1, 2, 3, 4, 5]
  ?        ---
  + [1, 2, 4, 5]
FAILED tests/test_coverage.py::SimpleStatementTest::test_break - AssertionError: [1, 2, 3, 5] != [1, 2, 3, 4, 5]
assert [1, 2, 3, 5] == [1, 2, 3, 4, 5]
  At index 3 diff: 5 != 4
  Right contains one more item: 5
  Full diff:
  - [1, 2, 3, 4, 5]
  ?           ---
  + [1, 2, 3, 5]
FAILED tests/test_coverage.py::SimpleStatementTest::test_continue - AssertionError: [1, 2, 3, 5] != [1, 2, 3, 4, 5]
assert [1, 2, 3, 5] == [1, 2, 3, 4, 5]
  At index 3 diff: 5 != 4
  Right contains one more item: 5
  Full diff:
  - [1, 2, 3, 4, 5]
  ?           ---
  + [1, 2, 3, 5]
```

We build the .pip files on Mac.  Some transitive dependencies are
different on other OS's, and so would fail there, like this:

```
ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    SecretStorage>=3.2 from https://files.pythonhosted.org/packages/54/24/b4293291fa1dd830f353d2cb163295742fa87f179fcc8a20a306a81978b7/SecretStorage-3.3.3-py3-none-any.whl#sha256=f356e6628222568e3af06f2eba8df495efa13b3b63081dafd4f7d9a7b7bc9f99 (from keyring==23.13.1->-r requirements/dev.pip (line 279))
```

By keeping the .in files self-contained, we provide a way to install
without hashes.

With .ref, on a PR from a fork, I got:
```
Run actions/dependency-review-action@v3
  with:
    base-ref: master
    head-ref: xml_duplicate_fix
    repo-token: ***
    fail-on-severity: low
    fail-on-scopes: runtime
Error: Bad Request
```

* fix: generate xml report packages correctly on windows

* test: check duplicate package names in xml report

* fix: shorten long line in test_xml

…ty location

There is logic to not measure third-party packages inside configured sources. However, when a (i.e. another) configured source was inside a third-party location, this logic was previously disabled completely.

This caused a problem if a virtual env is set up inside a configured source directory and a configured source package gets installed inside the virtual env. Previously in this case, coverage was measured for all files in the virtual env for the reason described in the previous paragraph.

This commit changes the code to collect all configured source directories inside third-party locations and disable coverage for code in third-party locations only if its not in one of these collected source directories.

Co-authored-by: KotlinIsland <kotlinisland@users.noreply.github.com>
Co-authored-by: Ned Batchelder <ned@nedbatchelder.com>