dedupe: respect --tag

I'm doing this in my release script:

```
$ npm install --tag release
$ npm dedupe
```

This causes npm to look into the package.json for modules it wants to move to find the best version. If a newer version is in the registry, npm will install the new version.

With this patch, `npm dedupe --tag release` prefers the tagged version if available.