Whatever we do, I beg that we don't make this the default behaviour of
package-install. There are probably plenty of people (me included) who
use it as way to ensure a package is installed (without worrying about
most recent version).

We can add a command `package-update', or add an extra optional argument
(something like `update-if-installed').