Add Support for Updating Only a Single Package

[emma-hughes-alianza]

In order to reduce exposure to security bugs, it may be desirable not to
take all available updates late in the release process when trying to
take a fix to a specific CVE, as very new updates are more likely to
have unidentified security bugs. This work allows you to take an update
only to specified RPMs, meaning that users can update only those
packages required in order to address CVEs without creating additional
risk late in the release process.

This adds a -p --package flag to the rpmoci update command that the user
can specify a particular package (or packages with multiple uses of the
CLI arg) with. The tool then effectively locks every other package in
place before resolving updates so that only that package changes. Where
multiple identical version of a package are available from multiple
sources it uses the version from the old lockfile to avoid unneeded
changes in diffs, even though the result is the same. We also add unit
and integration tests to verify behaviour.

Note that updating a specific package may require updating others if
they impose strict version controls - therefore you may need to provide
several -p parameters.

Tested by taking months old rpmoci.lock and rpmoci.toml from sas-dbapp
and running -p updates on packages that are present and not, and that do
and do not have changes.