Semver handling doesn't work for Apple RSRs

[iansltx]

💥  Actual behavior

Apple RSRs (e.g. macOS 13.5.1 (a)) fail to parse in semver.NewVersion(), causing issues like #22829. We have a workaround for that particular issue, but elsewhere in our codebase we'll still fail.

🧑‍💻  Steps to reproduce

1. Find a usage of semver.NewVersion()
2. Pass it one of the RSR versions (a version suffixed with a letter in parentheses) specified in TestOperatingSystemRequiresNudge.

🕯️ More info

We're using a third-party package for Semver parsing, so first order of business is to see if upgrading to the latest (major) version (3.3.0 as of this ticket's creation) fixes the issue (it probably doesn't). Next step is finding out whether contributing a fix upstream would be accepted, and if not whether we wrap this behavior in the codebase (in the ten places it's used) or fork the entire library.

[RachelElysia]

@lucasmrod : Do we know in what these 10 places breaks with this?
@iansltx : Nudge was originally not catching this, we now have a fix for that, but let's build a global, less hacky workaround
@lucasmrod : Maybe vuln scanning on these devices?

[RachelElysia]

Estimation: 3 including QA

[ksykulev]

Here is the "official" regex to parse semver > https://regex101.com/r/Ly7O1x/3/

As you can see by adding 13.4.1 (c) does not match the regex specified. In order to allow for this the regex could be modified as follows
^(?P<major>0|[1-9]\d*)\.(?P<minor>0|[1-9]\d*)\.(?P<patch>0|[1-9]\d*)(?:-|\s(?P<prerelease>\(?(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*\)?))?(?:\+(?P<buildmetadata>[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$
most notably add a \s on Col 74 and \(? on Col 91 and a \)? on Col 181 (these Col numbers are valid if you add all recommended characters)

Given that (c) postfix is not technically valid "semver" according to semver.org, the three recommended approaches:

A) Add a PR to amend the parsing
-> this seems like it will get push back as this string does not match the official semver regex
B) Wrap our usages of semver in fleet with a small util that handles this case
-> I am leaning towards this approach, as this is a weird edge case. This is also the lowest amount of short term and long term effort.
C) fork the official semver repository
-> In the process of creating a PR for option A), I can fork the repository on the fleet github account, allow us to use this fork until or if this PR gets merged upstream. Keeping a fork up to date with upstream is always a chore.