PUP-2882 Fix upgrade behavior

This PR adds a check to ensure that the module being upgraded is available on the Forge before attempting to resolve the graph and makes the constraint that we disallow downgrades an explicit part of the graph.