pecan.depends.R: `ensure_version` updates target package but not its dependencies

[Chris Black]

Local debugging of the current check failures on 4.1 shows they're from dplyr refusing to load because the installed version of tidyselect was too old.

This was caused by the remotes::install_version(pkg, dependencies = TRUE, upgrade = FALSE) added to pecan.depends.R in #3244: Apparently "dependencies = TRUE" only installs dependencies that are not already installed, and does not upgrade ones with installed but unsuitable versions.

Options I see: switch to upgrade = TRUE and accept that will pull in large numbers of updates to old systems, or parse dependencies ourselves inside ensure_version to upgrade only as far as the package requires.

Originally posted by @infotroph in #3237 (comment)