Add guardrails to prevent users from upgrading out of the shared framework

[natemcmaster]

Follow-up to #1180

Originally, we intended to use package version constraints as a guardrail to prevent users from hoisting out of the shared framework. This caused enough usability issues that we removed this guardrail in 2.1.1 in #1186.

There are other ways we could implement the guardrails, such as abusing the platform manifest trimming in the SDK. See #1180 (comment) for details. We should investigate more if this is something we can do in 2.1.3

cc @davidfowl @DamianEdwards

[natemcmaster]

After lots of internal investigation and discussion, I do not believe we have yet found a good, working proposal for implementing guardrails. The variety of complex scenarios surrounding ref and runtime assembly versioning creates too much risk for a patch. We will explore alternatives.

cref discussion here: https://github.com/aspnet/specs/pull/172