ContainsSemver checks if semver version v is in the range encoded by ar.

This is a modified copy of pkgsite/internal/stdlib:VersionForTag.

Less returns whether v1 < v2, where v1 and v2 are semver versions with either a "v", "go" or no prefix.

NonSupersededFix returns a fixed version from ranges that is not superseded by any other fix or any other introduction of a vulnerability.

Valid returns whether v is valid semver, allowing either a "v", "go" or no prefix.