Currently, osv-scanner fix has two flags:

• --disallow-major-upgrades (bool), which prevents major updates in all packages
• --disallow-package-upgrades (list of string), which prevents all updates to the listed packages.

We should replace these flags with per-package allowed update levels e.g. --allowed-upgrades=foo=none,bar=major,baz=minor.

Syntax might be a bit tricky and needs some thought:

• Should this be allowed-upgrades or disallowed-upgrades?
• Is pkg1=type1,pkg2=type2 okay syntax for all ecosystems? (i.e. does any ecosystem allow for '=' in a package name?)
• How to apply rules to all packages (e.g. all=major could refer to the package named all)
• What can be allowed.? e.g. major/minor/patch/none
  • Consider what this would mean for non-semver ecosystems
  • Maybe allow for some regex rules to deal with e.g. com.google.guava:guava having versions that end with -jre and -android