Clean up the `cargo update` implementation a bit

Clean up the `cargo update` implementation a bit

I've noticed some slightly odd output from `cargo update` in the past and I
believe this cleanup should address what's going on under the hood. There were a
few minor issues with the previous implementation.

* When adding the previous graph to the list of changes, packages with multiple
  versions would override one another instead of all get added to one list.
* The `Ord` implementation for `SourceId` was actually incorrect in that it
  disagreed with the `Eq` implementation. This could end up causing subtle bugs
  here and there. dependening on what operators were used.

This tweak fixes both points and I believe should touch up the odd output I've
been seeing from `cargo update`.