fix(sc4): pass version to OSV for all requirement operators, not just == and <=

[tcconnally]

Summary

Fixes #43: SC4 reports all historical CVEs when requirements.txt uses >=, >, ~=, or != operators.

Root Cause

_extract_packages_from_requirements() only forwarded the version to query_batch() for == and <= operators. For all other operators (>=, >, ~=, !=), version=None was passed to the OSV.dev API, which returns all historical CVEs for that package.

# Before: only == and <= passed version
version = m.group(3) if m.group(2) in ("==", "<=") else None

# After: all operators pass version
version = m.group(3) if m.group(2) else None

Fix

Pass the bound version for all requirement operators. OSV.dev uses the version to filter CVEs — passing "1.26.0" for "numpy>=1.26.0" returns only CVEs affecting that version, not all 20+ historical advisories.

Example

requirements.txt	Before	After
numpy>=1.26.0	Reports 20+ CVEs going back to 2019	Reports only CVEs affecting >=1.26.0
Pillow>=10.4.0	Reports all historical CVEs	Reports only relevant CVEs
httpx==0.27.0	Correct (unchanged)	Correct (unchanged)

Testing

All 622 tests pass. Backward compatible — == and <= behavior unchanged.