Only allow 1 patch release update increment in Cron

Problem/Motivation

If someone has set their site to updated automatically via Cron then there is no reason it should need to update more that 1 patch version at a time via cron.

If someone turns on updates via cron and they are currently more than 1 patch release behind they could be prompted to update the latest release via the UI. This would mean they would then get all patch releases as they are released unless they can't be applied because they have DB updates. see #3252126: Do not apply updates during cron if there are DB updates in the staging area.

If we only choose the latest release on the installed minor then there is more chance there will be DB updates in the update from the current version to the most recent version.

Steps to reproduce

Proposed resolution

This is will need #3252190: Store all installable releases in update_calculate_project_update_status()

1. After that is committed we should either, update `\Drupal\automatic_updates\UpdateRecommender::getRecommendedRelease()` to send in something like $is_cron or just add another method.
2. add a Readiness check validator warn if cron is enabled and the site is multiple patch release behind instructing the user update via the UI

Remaining tasks

Decide the behavior during cron if the site multiple patch release behind
options:

1. Don't allow updating at all
2. If the next patch release, for example if the site is on 9.5.4 the next patch release would be 9.5.5, is installable and has no DB updates apply it. This would mean that if a site is on 9.5.4 and the latest release in the minor is 9.5.7 then if all the releases between 9.5.5 and 9.5.7 are installable and have no DB updates then in 3 cron runs the site would be 9.5.7.

User interface changes

API changes

Data model changes