fix: Stop a provider being downloaded twice if it's not in the dep lock file and is used in both the source and destination