don't blindly clobber local dist-tags

If packages are being published to verdaccio as well as upstream to
npmjs.org, then when the cache is updated from npmjs.org it uses the
dist-tags from the upstream even if the locally published version is
actually newer. This makes it very difficult to use verdaccio as a
staging registry for testing out potential releases.

This change partially reverts a change in behaviour that was introduced
in rlidwka#8 which caused a regression for the staging style workflow that was
supported by sinopia.

Author: rmg

lib/storage.js

@@ -511,8 +511,8 @@ Storage._merge_versions = function(local, up, config) {
   // refresh dist-tags
   for (var i in up['dist-tags']) {
     if (local['dist-tags'][i] !== up['dist-tags'][i]) {
-      local['dist-tags'][i] = up['dist-tags'][i]
-      if (i === 'latest') {
+      local['dist-tags'][i] = Utils.semver_sort([up['dist-tags'][i], local['dist-tags'][i]]).reverse()[0]
+      if (i === 'latest' && local['dist-tags'][i] === up['dist-tags'][i]) {
         // if remote has more fresh package, we should borrow its readme
         local.readme = up.readme
       }