Add a comment clarifying repoTarballPkgsWithMetadata are all SecureRepos

Clarify that repoTarballPkgsWithMetadata are all SecureRepos, so this
can be easily refactored in the future.

# Please enter the commit message for your changes. Lines starting
# with '#' will be ignored, and an empty message aborts the commit.
#
# Commands:
#   q          Close
#   <c-c><c-c> Submit
#   <c-c><c-k> Abort
#   <m-p>      Previous Message
#   <m-n>      Next Message
#   <m-r>      Reset Message
#
# On branch fix/exe-incomplete-record-selectors
# Your branch is up to date with 'origin/fix/exe-incomplete-record-selectors'.
#
# Changes to be committed:
#	modified:   cabal-install/src/Distribution/Client/ProjectPlanning.hs
#
# Untracked files:
#	.direnv/
#

Author: sgillespie

cabal-install/src/Distribution/Client/ProjectPlanning.hs

@@ -1245,6 +1245,8 @@ getPackageSourceHashes verbosity withRepoCtx solverPlan = do
                       | pkgid <- pkgids
                       ]
                 | (repo, pkgids) <-
+                    -- All Repos here are SecureRepos (and will have a name), so we're
+                    -- sorting Justs
                     map (\grp@((repo, _) :| _) -> (repo, map snd (NE.toList grp)))
                       . NE.groupBy ((==) `on` (fmap remoteRepoName . maybeRepoRemote . fst))
                       . sortBy (compare `on` (fmap remoteRepoName . maybeRepoRemote . fst))