Fix kpm restore with global.json

- Use the global.json as the single source of facts. No project.json is
  needed.
- Strictly restore the packages in global.json. No more no less.

parent #501 
`restoreOperations.FindLibraryCached` doesn't do that. I should add check for exact version.