Handle updates to version requirements in lockfiles

This is the same as the fix for #951 (fixed by #965). The relevant code was
erroneously looking at the source id when it should instead look at the entire
package id (name/version/source).
auto merge of #990 : alexcrichton/cargo/update-blows-up, r=brson

This is the same as the fix for #951 (fixed by #965). The relevant code was
erroneously looking at the source id when it should instead look at the entire
package id (name/version/source).