Fix parsing of version #'s of dependencies

[jbalint]

Version #'s with patch info like "1.1.1-x" would cause an error. Now
tokenize the version string with "." AND "-".

Some versions of OTP return an unexpected version #:

8> application:get_key(ssl, vsn).
{ok,"6.0.1-basho1"}

This was causing a bootstrap error:

./bootstrap
===> Updating package registry...
===> Writing registry to /home/jbalint/.cache/rebar3/hex/default/registry
===> Generating package index...
===> Writing index to /home/jbalint/.cache/rebar3/hex/default/packages.idx
===> Verifying dependencies...
===> Fetching bbmustache ({pkg,<<"bbmustache">>,<<"1.0.4">>})
escript: exception error: no match of right hand side value
                 {error,
                     {rebar_fetch,
                         {fetch_fail,{pkg,<<"bbmustache">>,<<"1.0.4">>}}}}

[tsloughter]

Thanks!