Pkg2.installed(): return map of package names to installed versions.

Unlike Pkg.installed(), Pkg2 contructs a "synthetic" ± version number
even for packages that are not on a registered version, so it always
returns a VersionNumber, never a SHA1 string. Closes #4022.