Fix parsing and comparing versions with build information

[bpfoster]

This regex is pretty complex and I don't grok it all. I found that removing the last ? allows expected results when build information is present, and does not break any existing scenarios covered by unit tests.
With 2 ?'s, regex101 describes this as

?? matches the previous token between zero and one times, as few times as possible, expanding as needed (lazy)

vs with 1 ?:

? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)

Additionally I added multiple test cases to validate build information being handled as expected. Per the semver spec, "Build metadata MUST be ignored when determining version precedence" - added test cases verify that it is in fact ignored as expected.

fixes #7

[knqyf263]

Thanks

[bpfoster]

Do you require me to update go-version in go.mod in trivy or will this get picked up in another manner?

[knqyf263]

You can open a PR bumping go-version.