Support version locking a la npm

@lyonlai had an interesting suggestion of being able to lock specific packages to a version range. The idea being that you could then just type hermit upgrade and everything would be upgraded within the specified constraints. It could be similar to npm's [approach](https://github.com/npm/node-semver#versions), but encoded in the symlink chain. eg.

```
hermit install openjdk~17.0.2
```

(note the tilde) would allow patch level upgrades automatically, but not minor version upgrades

This could be encoded in the symlink chain as you would expect

```
javac -> .openjdk~17.0.2.pkg -> hermit
```

After some thought I don't think this would be the best approach, as it would require Hermit to do constraint matching against all available versions of the package on every stub execution. A better approach might be to add a `constraints` option to the environment's config, eg.

```hcl
constraints = {
"openjdk": "^17"
}
```

This would be automatically managed by `hermit install/upgrade/uninstall`. `hermit upgrade` would upgrade the bin links to the latest version that satisfies the constraint.

Start by tracing the hermit install, upgrade, and uninstall commands and how the environment's config and symlink chain are currently managed. Compare the proposed version-range syntax with npm's semver approach, then define how constraints are stored and how upgrade selects a satisfying version; done means the behavior is specified across installation, upgrading, and removal.

Written by the indexing model from the issue text.