Allow updating transitive deps

Allow updating transitive deps

Previously `cargo update foo` would only update the package `foo` if it were a
direct dependency of the local package. This meant that to update a transitive
dependency you would have to update the top-level dependency.

This commit adds the ability to update any dependency by name, regardless of
where it is in the dependency graph. This commit is a bit lossy in terms of
behavior. We are guaranteed that the set of immediate dependencies for any one
package have unique names, but not for the entire package graph. This means that
when you invoke `cargo update foo` it could possibly update two packages named
`foo`.

I believe this behavior to be acceptable for now and we can add a more stringent
update syntax later (something like `cargo update --namespace foo bar`). I
believe we'll always want this CLI usage, however.