feat(exposure): add any-version ("*") catalog entries in schema v0.2.0

[adel-pplx]

Summary

Adds schema v0.2.0: a catalog entry may declare "versions": ["*"] to match every version of a package. tools/osvcatalog now emits ["*"] for OSV affected entries whose ranges declare all versions affected (a single introduced: "0" SEMVER/ECOSYSTEM event) instead of dropping them — on the current OSV npm dump this raises coverage from ~17.9k to ~214k entries (196k any-version). v0.1.0 catalogs are still accepted and cannot use "*"; bounded ranges remain out of scope.

Fixes #64

Notes: a regenerated full npm catalog is ~63.4 MiB, just under the 64 MiB default --max-catalog-size. Catalogs in one directory must still share a single schema_version, so a second commit bumps the shipped threat_intel/ catalogs and the embedded selftest catalog to 0.2.0 (entry content unchanged) to keep them mergeable with generated catalogs.

Tests

• exposure: any-version match (arbitrary and empty record versions, miss for other packages), "*" mixed with exact versions rejected, "*" under schema 0.1.0 rejected, both supported schema versions parse.
• osv: all-versions SEMVER/ECOSYSTEM ranges emit ["*"] while bounded and GIT-only ranges stay skipped, wildcard wins over enumerated versions for the same package, and a generated catalog round-trips through exposure.LoadFile and matches an arbitrary version.
• scanner: finding for an any-version entry carries the installed version and distinct evidence text.
• Manually regenerated catalogs from current OSV npm and Go dumps; both validate against the v0.2.0 schema and a live scan flags a wildcard-covered package.

Checks

• gofmt / go vet / go test / go test -race / go build / selftest — pass.
• govulncheck — reports Go stdlib advisories from the local toolchain patch level only, in files untouched here; enforced by CI.