Handle updates to version requirements in lockfiles

This is the same as the fix for #951 (fixed by #965). The relevant code was
erroneously looking at the source id when it should instead look at the entire
package id (name/version/source).