Denied packages should be hidden from `winget upgrade` list

Description of the new feature / enhancement

Packages that have UpgradeBehavior: deny set should be hidden from winget upgrade / winget list --upgrade-available list. We can have an argument --include-denied to show these packages. The current output for pinned, unknown and explicit targeted packages can be extended to show number of denied packages.

Current sample output

The following packages have an upgrade available, but require explicit targeting for upgrade:
Name                         Id              Version      Available            Source
-------------------------------------------------------------------------------------
Discord                      Discord.Discord 1.0.9016     1.0.9035             winget
Microsoft Teams              Microsoft.Teams 1.6.00.29964 23320.3027.2591.1505 winget
Teams Machine-Wide Installer Microsoft.Teams 1.5.0.8070   23320.3027.2591.1505 winget
1 package(s) have version numbers that cannot be determined. Use --include-unknown to see all results.
21 package(s) have pins that prevent upgrade. Use the 'winget pin' command to view and edit pins. Using the --include-pinned argument may show more results.

New sample output line

1 package(s) do not support upgrades through winget. Use --include-denied to see more results.

Proposed technical implementation details

No response

Start by tracing the winget upgrade and winget list --upgrade-available command paths and how UpgradeBehavior: deny is represented. Check the existing handling for pinned, unknown, and explicitly targeted packages, then identify the argument and output tests covering these commands. Done means denied packages are excluded by default, --include-denied reveals them, and the summary reports their count.