Keep the self-hosted Git service pinned during fleet patching

Fleet patching upgrades every package on a machine. The self-hosted Git service is an ordinary package on one of those machines, so a routine patch run would have carried it from 18.11 to 19.3 in a single step.

That product requires each major series to be installed in order, and skipping them can leave the database schema inconsistent. Upgrades are performed deliberately, by a separate run that walks the supported path.

The package is now held for the duration of the patch run and released immediately afterwards, so the machine still receives its operating-system and security updates while the application stays where it is.