add --no-install flag to devbox update

[jay-aye-see-kay]

Summary

As part of getting devbox working in renovate, we need to run devbox in renovate's base image (added here containerbase/base#3191). The problem is the way nix is installed (already in that image) it cannot actually install anything. This is because it's a quirky variant of a single user install where all the /nix/* paths are set to custom values.

We can work around this by just having devbox update the lockfile but not actually install anything (which is also a speed win) - but this functionality doesn't seem to available in the devbox cli currently.

This is a potential implementation adding what we need for renovate to upgrade devbox projects. Happy for you to do it another way. The approach we've taken seems like it's misusing the mode variable a little bit.

How was it tested?

Manually tested only; run locally on a macbook, plus in the container linked above.

• add some packages that are older
• upgrade them by manually editing devbox.json
• run devbox update --no-install to update all packages in devbox.lock to latest within ranges devbox.json
• in the container this failed with cmd.path=/usr/local/bin/nix cmd.stderr="cannot connect to socket at '/tmp/containerbase/cache/nix/state/daemon-socket/socket': No such file or directory" but with this change it works
• run devbox update nodejs --no-install also works for a single package
• changes to lockfile seem to be the same as devbox update without the flag, so behaviour of this flag shouldn't surprise anyone