Strict option for downloading release XML

Currently the package manager kindly defaults to downloading the latest recommended release of a project if you pass it bogus release info. This is convenient, but it would be nice if you could tell it to fail if you pass it bad release info.

This is useful in drupalorg_drush, where we need to verify that a release actually exists as part of building a profile's metadata.

The attached patch simply expands on the functionality of a switch arg, (formally $dev) which certain functions used to restrict operations to development branches. This has been converted to a string arg $restrict_to, with options of 'dev' (old $dev switch enabled), 'version' (new exact version restriction enabled), and '' (old $dev switch disabled).

There were some places where the dev restriction was used besides parsing release XML; in those cases I just made our new arg work like the old.

Patch works to fix the problem in drupalorg_drush, now tossing it over the fence for general consideration.