Securities are not always updated when those aren't direct dependencies

[omarlopesino]

It happened that the script wasn't able to update the drupal core latest security, when the project has drupal/core-recommended installed.

It looks like as not the complete metapackage has been updated, it is not possible to independently upgrade drupal core.

Steps to reproduce

• Have a site with Drupal 9.4.11 or lower / 9.5.4 or lower / 10.0.4 or lower , but with drupal/core-recommended in the requirements.
• Run drupal-updater --security

[omarlopesino]

After thinking about it I conclude that drupal updater must rely on the constraints, otherwise, modules can be calculated automatically.

[omarlopesino]

After thinking again a good solution would be:

• Detect if a security package is a transitive dependency, then detect the direct dependency, and then update that direct dependency