feat(build): summer plugin:update

- module installs move to the newest compatible registry release with
  one go get; submodules fetch tags, check out the release tag and
  require it in go.mod; go.work overrides and version pins are refreshed
- unlisted submodules (git URL installs) update from their own tags and
  plugin.yaml; --offline restricts to that
- without an ID every plugin that resolves is updated; in-app, unlisted
  and incompatible ones are reported; failure only when a resolved
  update cannot be carried out
- same prompt rule as plugin:install

modules/kiosk/README.md

@@ -146,7 +146,7 @@ func TestPluginManifest(t *testing.T) {
 
 | Key | Default | Meaning |
 |-----|---------|---------|
-| `plugins.registry_url` | `https://summercms.io` | Registry origin for `summer plugin:install` and the admin's Plugins screen (file `config/plugins.yaml`, env `SUMMER_PLUGINS__REGISTRY_URL`). It must be the final origin, because redirects are not followed. An empty value disables registry calls. |
+| `plugins.registry_url` | `https://summercms.io` | Registry origin for `summer plugin:install`, `summer plugin:update` and the admin's Plugins screen (file `config/plugins.yaml`, env `SUMMER_PLUGINS__REGISTRY_URL`). It must be the final origin, because redirects are not followed. An empty value disables registry calls. |
 
 ## CLI commands
 
@@ -154,6 +154,7 @@ func TestPluginManifest(t *testing.T) {
 |---------|---------|
 | `summer plugin:manifest [dir]` | Writes `plugin.yaml` for the plugin in `dir` (default: the current directory). `--pretend` prints it instead, `--check` fails when the committed file is missing or stale, `--name` and `--description` set or (with an empty value) clear the overrides. |
 | `summer plugin:install <id\|git-url>` | Installs a plugin; reads its releases through `kiosk.Client` and picks one with `kiosk.NewestCompatible`. See [Installing plugins](../../docs/plugins/marketplace.md#installing-plugins). |
+| `summer plugin:update [id]` | Moves installed plugins to their newest compatible release, read through `kiosk.Client`. See [Updating plugins](../../docs/plugins/marketplace.md#updating-plugins). |
 
 ## Dependencies