outdated: only test 'from' for urls

If the 'from' value is not a url, then the fact that it changes is not
relevant.  For example 'foo@*' and 'foo@1' and 'foo@' might all point to
the same package.  However, a changed url IS relevant, because it
indicates that it is now a different thing.

Fixes #3798, a regression caused by #3578.