In 2.x we automatically upgraded to the latest patch version when it was released. That was helpful for security-related fixes but really bad if the version had new bugs. In 3.0 the user chooses the exact version they want to install (e.g. v1.20.1), so they can pin the patch version. This issue is about adding the old behaviour as an option, if the user specifies just a minor version (e.g. v1.20)

Acceptance Criteria:

• If spec.version does not have a patch version, the latest patch version is always installed