Support version locking a la npm

[alecthomas]

@lyonlai had an interesting suggestion of being able to lock specific packages to a version range. The idea being that you could then just type hermit upgrade and everything would be upgraded within the specified constraints. It could be similar to npm's approach, but encoded in the symlink chain. eg.

hermit install openjdk~17.0.2

(note the tilde) would allow patch level upgrades automatically, but not minor version upgrades

This could be encoded in the symlink chain as you would expect

javac -> .openjdk~17.0.2.pkg -> hermit

After some thought I don't think this would be the best approach, as it would require Hermit to do constraint matching against all available versions of the package on every stub execution. A better approach might be to add a constraints option to the environment's config, eg.

constraints = {
  "openjdk": "^17"
}

This would be automatically managed by hermit install/upgrade/uninstall. hermit upgrade would upgrade the bin links to the latest version that satisfies the constraint.