report pr status messages as appropriate

[brettfo]

Changes are for the new end-to-end updater and are not live.

This PR adds the final bits of PR handling messages and will report things like update_pull_request, pull_request_exists_for_latest_version, security_update_not_needed, etc.

The bulk of the tests were copied from the existing Ruby implementation and slightly tweaked to better represent the NuGet ecosystem.

This also required more strongly typed values for existing pull requests. In the JSON they're represented as an array of array of dependencies and that's what the old model represented, but now they're more strongly typed. Consider the following example that better shows the structure:

{
  "job": {
    // ...
    "existing-pull-requests": [
      // pull request 1
      [
        {
          "dependency-name": "Some.Dependency",
          "dependency-version": "1.2.3"
        }
      ],
      // pull request 2
      [
        {
          "dependency-name": "Some.Other.Dependency",
          "dependency-version": "4.5.6",
        }
      ]
    ]
    // ...
  }
}

[brettfo]

This main loop is a bit more complicated now because we need to report certain types of PR messages immediately and other types later once we've done some update analysis. In either case we need to track that we've already reported on that PR so we don't report on it again at the end, where we need to report on anything not reported on yet.