Port the update:lightning command from the 6.0.x branch

The next major versions of all Lightning components will remove all their dependencies. This will break sites unless those constraints are moved to the top-level composer.json.

Therefore, let's do here what was done in the 6.0.x branch, which is change the update:lightning Drush command so that it moves the dependencies' constraints into the top-level composer.json.

However, let's do it differently here -- in this branch, it should pin the dependencies to their installed versions, rather than use unpinned constraints. This will prevent unexpected updates.

The 6.0.x branch won't be able to do that, because it is related to the new major branches of the components...which remove the dependencies. So it will have no way to know what versions are installed (since they won't be installed).