Should install / update default to --latest

[guybedford]

Currently we maintain secondary out-of-semver-range versions as locks. Unless setting --latest, it could be worth explicitly having this as the default, possibly even deprecating --latest.