`paket update` does not restrict the packages to those compatible only with .NET 6 in the SAFE template

Description

This is the dependency file for the SAFE template at the time of writing.

source https://api.nuget.org/v3/index.json
framework: net6.0
storage: none

nuget Fsharp.Core ~> 6
nuget Fable.Remoting.Giraffe
nuget Saturn
nuget Expecto

nuget Fable.Core
nuget Fable.Elmish
nuget Fable.Elmish.React
nuget Fable.Elmish.Debugger
nuget Fable.Elmish.HMR
nuget Fable.Mocha
nuget Fable.React
nuget Fable.Remoting.Client
nuget Feliz
nuget Feliz.Bulma
nuget Fulma

nuget Fake.Core.Target
nuget Fake.IO.FileSystem
nuget Farmer

Note that it targets .NET 6. When I do a paket update with all the projects removed from the solution file, it finishes fine. But with the projects there, I get an error.

E:\Webdev\Fable\Safe Stack Examples\full\src\Server\Server.fsproj : error NU1202: Package Microsoft.AspNetCore.Authentication.JwtBearer 7.0.3 is not compatible with net6.0 (.NETCoreApp,Version=v6.0). Package Microsoft.AspNetCor
e.Authentication.JwtBearer 7.0.3 supports: net7.0 (.NETCoreApp,Version=v7.0) [E:\Webdev\Fable\Safe Stack Examples\full\full.sln]
  Restored E:\Webdev\Fable\Safe Stack Examples\full\src\Client\Client.fsproj (in 150 ms).
  Failed to restore E:\Webdev\Fable\Safe Stack Examples\full\src\Server\Server.fsproj (in 154 ms).
  Restored E:\Webdev\Fable\Safe Stack Examples\full\src\Shared\Shared.fsproj (in 150 ms).
  Restored E:\Webdev\Fable\Safe Stack Examples\full\Build.fsproj (in 150 ms).

And indeed, if I look at the lock file, I see something like...

    Microsoft.AspNetCore.Authentication.JwtBearer (7.0.3)
    Saturn (0.16.1)
      FSharp.Control.Websockets (>= 0.2.2)
      Giraffe (>= 6.0)
      Microsoft.AspNetCore.Authentication.JwtBearer (>= 6.0.3)

There is a constraint missing that the package should be the latest targeting .NET 6. It instead gets the .NET 7 compatible package.

Repro steps

Assuming that the SAFE template 4.2.0 is installed and paket 7.2.0 is installed globally:

dotnet new SAFE
paket update

Known workarounds

Adding nuget Microsoft.AspNetCore.Authentication.JwtBearer ~> 6 into the paket.dependencies fixes the issue.

Reproduce with dotnet new SAFE followed by paket update, then compare the generated lock file with the paket.dependencies constraints and the failing .NET 6 restore. Trace Paket's dependency resolution for Microsoft.AspNetCore.Authentication.JwtBearer; done means the SAFE template update selects a package compatible with net6.0 without requiring the manual constraint.