core: Lock in plugin install of a specific version