chore: Sync upstream

[spiffcs]

Description

Sync this fork with hashicorp/go-version picking up 93 upstream commits since the fork point (59da58c) while preserving Anchore commits.

We are unarchiving this repository and maintaining it as part of Anchore, so this merge establishes the baseline that future syncs build on. No contributed Anchore behavior changes in this PR.

Anchore changes preserved (none of them modified by this merge):

• Constraints as [][]*Constraint, supporting || (or) constraints
• the ^ (caret) and ~ (tilde) constraint operators
• MarshalJSON / UnmarshalJSON on Version and Constraints
• comparison operators do not apply prereleaseCheck, per semver spec item 11
• comparePart ordering for empty prerelease parts
• module path github.com/anchore/go-version, and README badges/links pointing at this fork

Upstream changes that needed adapting to our 2D Constraints type:

Upstream refactored constraint.go in ways that assume the flat Constraints []*Constraint, so three things were reconciled rather than taken verbatim:

1. Upstream replaced the constraintOperators map (and its init()-built regexp) with a lazily-compiled getConstraintRegexp() and a switch in parseSingle. Our ^ and ~ operators were added to both, plus caret/tilde entries in the operator constants. Regexp alternation keeps ~> ahead of ~ so pessimistic constraints still parse correctly.
2. Upstream added Constraints.Equals and sort.Interface on Constraints, both written against the flat type. These are now: constraintGroup (sorts the constraints inside one comma-separated conjunction), Constraints.sorted() (sorts the groups and their contents), and Constraints Len/Less/Swap (order the || groups). TestConstraint_sort calls sorted() and passes upstream's expectations unchanged.
3. prereleaseCheck now uses upstream's new Version.equalSegments helper instead of reflect.DeepEqual on Segments64(), which drops the reflect import.

Notable upstream additions this brings in:

• WithPrefix parsing option, for stripping a known release prefix before parsing
• Version.Core(), returning just the MAJOR.MINOR.PATCH segments
• MarshalText / UnmarshalText, implementing the encoding text interfaces
• sql.Scanner / driver.Valuer, for reading and writing versions as SQL values
• MustConstraints, the Constraints counterpart to the existing Must
• correct comparison of numeric prerelease identifiers exceeding math.MaxInt64
• a fix for String() on a zero-value Version, which previously printed empty rather than 0.0.0

Upstream repo tooling (Makefile, .copywrite.hcl, CODEOWNERS, go-tests.yml, copywrite.yml, CHANGELOG.md, CONTRIBUTING.md, this PR template) is taken exactly as upstream ships it, so the diff stays reviewable as a pure resync. Replacing it with Anchore's standard tooling like go-make, binny, bouncer, chronicle, the anchore/workflows reusable workflows, golangci.yaml will be a follow-up PR stacked on this branch.

To verify locally:

git fetch origin sync-upstream && git checkout sync-upstream
go build ./... && go test ./...

To confirm nothing of ours was reverted, diff the Anchore-owned surface against the pre-merge tip:

git diff main...sync-upstream -- constraint.go version.go

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

0 out of 3 committers have signed the CLA.

• spiffcs
• wagoodman
• zburstein

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

0 out of 3 committers have signed the CLA.

• wagoodman
• spiffcs
• zburstein

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[spiffcs]

Apologies, this was meant to target our fork of go-version. Closing.