respect user pinning in M-A:same version (un)screwing

respect user pinning in M-A:same version (un)screwing

Using Pkg.CandVersion() here is wrong as its implementation will return
a candidate based just on the default policy settings ignoring user
preferences and otherwise set candidates (aka: it sidesteps the
pkgDepCache).

This causes M-A:same libraries to be detected as screwed even through
they aren't, so that they end up being kept back.

Reported-By: Felipe Sateler on IRC