run full updater on all dependencies, including transitives

[brettfo]

This PR only updates the end-to-end NuGet updater which is not yet used in production.

It allows updates to happen on both top-level and transitive dependencies. The result is a scenario that the hybrid Ruby/C# updater can't handle, but the end-to-end updater can.

The test has a dependency reported from three locations:

1. As a top-level dependency - up to date.
2. As a top-level dependency - needs update.
3. As a transitive dependency - needs pinning.

The hybrid updater can only update scenario 2 and misses the transitive dependency.