Unexpected non-match in version when build is present in constraint

[bpfoster]

I am encountering this via trivy, but have traced the behavior to this library.

If I have version 11.2.0, and a vulnerability has a parsed version constraint of >= 11.2.0, < 11.2.2+security-01 (from this vuln), I would expect the constraint to match.

Instead, there is no match. It appears that the +security-01 is throwing things off, it is parsed into a 3rd constraint of 01 that never matches.