Pkg: version_installed logic is clearer with if/elseif/else.
Pkg: when multiple versions have same SHA1, pick the max.

Previously, this situation could cause Pkg.resolve to think that
there were changes that needed to be made even though a package
was already on the resolved version. This was triggered e.g. by
versions 0.0.2 and 0.0.3 of HttpParser and 0.0.1 and 0.0.2 of
HttpCommon pointing at the same SHA1. Ideally this shouldn't
happen, but Pkg should handle it correctly if it does.