fix: use detected version for CVE lookup filtering

[HC-ONLINE]

Description

Fix CVE lookup to use the detected technology version instead of searching generically by product name only.

Problem

Previously, when fingerprinting detected a technology like jQuery 3.6.0, the CVE lookup would search for jQuery without the version, returning all CVEs for that product regardless of whether they affected the detected version. This caused noise and false positives.

Changes

1. AffectedProduct.matches_version() — Version range support

• File: src/ciberwebscan/core/analyzers/cve/models.py
• Replaced simple exact-match with full version range support
• Uses packaging.version.Version for semantic version comparison
• Handles versionStartIncluding and versionEndExcluding from CPE configurations
• Gracefully handles unparseable versions (assumes affected)

2. _lookup_cves() — Version-aware filtering

• File: src/ciberwebscan/services/analyze_service.py
• Now passes tech.version to the CVE aggregator
• Added _cve_affects_version() to post-filter CVEs by detected version
• Added deduplication of CVE entries across technologies

3. Dependency

• File: pyproject.toml
• Added packaging>=21.0 for semantic version parsing

Flow

BEFORE: 'jQuery 3.6.0' → searches 'jQuery' → returns ALL CVEs (noise)
AFTER: 'jQuery 3.6.0' → searches 'jQuery' + '3.6.0' → filters → only relevant CVEs

API Compatibility

All three CVE sources are supported:

• NVD: Uses CPE wildcard, filtering happens post-fetch via _cve_affects_version()
• CIRCL: Passes vendor/product, parses ranges from CPE configs
• Vulners: Sends version directly in the request

Testing

• All 1180 unit tests pass (no regressions)

Breaking Changes

None. This is a backward-compatible improvement.