Fix kpm restore with global.json

- Use the global.json as the single source of facts. No project.json is
  needed.
- Strictly restore the packages in global.json. No more no less.

parent #501 
This should look for the exact version of the package. Does it do that?