#4644 Respect dependency versions pinned with extension pull dep@version

After swamp-club#4634, swamp extension pull <name> and swamp extension update <name> upgrade the named extension's installed dependencies to latest. A dependency someone deliberately kept back with swamp extension pull <dep>@<version> (for example to avoid a bad release) is upgraded again by the next pull or update of anything that depends on it. The only way to avoid that today is passing --no-upgrade-dependencies every time.

The lockfile records the installed version but not whether it was chosen on purpose. Proposal: record an explicit pin on the lockfile entry when pull is given an exact version, have the dependency upgrade walk hold pinned entries, decide whether update with no name should also respect them, and give a way to clear a pin.