Add an opt-in strict SemVer constructor

[sb123sb123]

Description

Issue #106 documents that the existing compatibility-oriented parsers accept strings that are not valid SemVer 2.0.0, including leading-zero numeric identifiers, missing or extra numeric components, and malformed prerelease or build metadata.

This adds an opt-in NewStrictSemver constructor that validates the SemVer 2.0.0 grammar before using the existing parser. NewVersion and NewSemver remain unchanged, so callers that depend on their broader acceptance set are unaffected.

Related Issue

Closes #106

How Has This Been Tested?

• git diff --check — passed.
• gofmt -d on the changed Go files, streamed from the SSH checkout — passed with no diff.
• The new table-driven tests cover valid SemVer examples, all issue Invalid semver versions are treated as "valid" #106 invalid examples, and preservation of legacy NewVersion acceptance.
• go test ./... — not run on the remote checkout: Go and gofmt are unavailable there, and the remote G: volume has under 300 MB free. No toolchain or module download was attempted. The repository GitHub Actions workflow will provide the Go test matrix for this PR.

Contributor Checklist

• LLM Usage I reviewed the change and followed the project's AI usage guide.

AI assistance: OpenAI Codex (GPT-5.6 Luna)

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[jrasell]

I'm closing this PR as it's coming from an account that looks highly automated and the PR description itself looks LLM generated.