feature!: replace 'upem.donotup' with an 'upem.policies' section

[sverweij]

Description

• replaces upem.donotup with a upem.policies section
• removes the ability to just pass either a string or an array to the upem.donotup => it'll need to be an array of objects now (not a problem because all know consumers already use arrays of objects anyway)
• 🚨 BREAKING CHANGE in case you use upem.donotup

before

  "upem": {
    "donotup": [
      {
        "package": "slodash",
        "because": "slodash >4 is only compatible with node 23 and we still (have to) support node 10"
      }
    ]
  }

after

  "upem": {
    "policies": [
      {
        "package": "slodash",
        "policy": "pin",
        "because": "slodash >4 is only compatible with node 23 and we still (have to) support node 10"
      }
    ]
  }

Motivation and Context

Will enable policies different from just 'donotup' (now called 'pin' which seems more commonly understood), like 'latest' (the current default for upem) and 'wanted'. This last one is interesting when there's a breaking change in a major which you can't (yet) swallow, but the older version still gets non-breaking updates.

These policies will be added in a future PR.

How Has This Been Tested?

• automated non-regression tests & updated automated tests
• green ci

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• Documentation only change
• Refactor (non-breaking change which fixes an issue without changing functionality)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• 📖

  • My change doesn't require a documentation update, or ...
  • it does and I have updated it

• ⚖️

  • The contribution will be subject to The MIT license, and I'm OK with that.
  • The contribution is my own original work.
  • I am ok with the stuff in CONTRIBUTING.md.