Fix "kpm restore" with global.json

- Use the global.json as the single source of facts. No project.json is
  needed.
- Strictly restore the packages in global.json. No more no less.
- Restore exact version of a package when restoring with gloabl.json