Description of problem:
Any locks set with dnf versionlock are ignored when dnf-automatic triggers.  The interesting debug log entry is:
DEBUG Excludes from versionlock plugin were not applied
This traces to (and I don't know if this is current code):
https://github.com/rpm-software-management/dnf-plugins-core/blob/master/plugins/versionlock.py#L66

        if self.cli is None:
            pass  # loaded via the api, not called by cli
        elif not self.cli.demands.resolving:
            logger.debug(NO_VERSIONLOCK)
            return

Interestingly, dnf list triggers the same behavior.  While I can't dnf update a module past it's locked version -- dnf list will show all the versions (maybe this is by design).  However, dnf-automatic definitely shouldn't be ignoring versionlocks.  =)


Version-Release number of selected component (if applicable):
dnf 4.0.9.2-5.el8
dnf-automatic 4.0.9.2-5.el8
python3-dnf-plugin-versionlock 4.0.2.2-3


How reproducible:
Trivially, ever time dnf-automatic runs.


Steps to Reproduce:
1. dnf install dnf-automatic
2. dnf install python3-dnf-plugin-versionlock
3. dnf install https://yum.puppet.com/puppet6-release-el-8.noarch.rpm
4. dnf install puppet-agent-6.7.2
5. dnf versionlock add puppet-agent
6. dnf update puppet-agent (should show nothing to update, even though 6.8.* is out)
7. systemctl start dnf-automatic   (wait for it to complete but you should see it actually update puppet-agent to the latest despite the versionlock, and if you have debug enabled, can see /var/log/dnf.log explicitly say it's not using versionlock)


Actual results:
Updates puppet-agent to newer version than 6.7.2


Expected results:
Updates puppet-agent to whatever the latest is at the time


Additional info:
Obviously you don't have to pull in puppet-agent for this -- it was just the most obvious one to test with for me at the moment.