fix(arborist): Allow downgrades to hoisted version dedupe workspace i…

[owlstronaut]

fixes #7028

The crux of the issue as that when the downgrade was attempting to dedupe, there was nothing in the canDedupe logic that said it was okay to take the other version if it was an explicit request. It would see the 0.0.2 in the root, the 0.0.3 in the workspace, and give up, leaving them both as they were.

The proposed change adds a new parameter explicitRequest to the canDedupe method with a default value of false. This parameter enables dedupe behavior when a package version was explicitly requested by the user.

Adding the explicitRequest parameter introduces a new condition that allows deduping when:

• A user has explicitly requested a specific package version via commands like npm install package@version
• None of the other deduping criteria are met
• The current version isn't already the result of an override

I believe this was just an edge case that wasn't handled in the dedupe logic, and this change should fix it.

[fritzy]

Pretty straight forward change, good explanation, good test coverage.