refactor(lang): use MatchVersion instead of IsVulnerable for Comparer interface

[DmitriyLewen]

Description

Refactored the Comparer interface in the library detection system to use a cleaner MatchVersion function instead of IsVulnerable. This change simplifies version comparison logic by separating constraint matching from vulnerability
assessment.

Changes

• Interface Refactoring: Changed Comparer interface from IsVulnerable(currentVersion, advisory) to MatchVersion(currentVersion, constraint)
• Code Organization: Moved GenericComparer from pkg/detector/library/compare/ to pkg/detector/library/compare/generic/
• Logic Separation: Extracted common IsVulnerable function into driver.go, centralizing vulnerability assessment logic
• Test Updates: Updated all comparator tests to use the new MatchVersion interface and added proper error handling
• Package Cleanup: Removed unused imports and simplified package dependencies across all comparator implementations

Related PRs

• Root.io application level vulnerability implementation #9427. We’ll need to implement a new IsVulnerable that checks only VulnerableVersions and doesn’t check PatchedVersions.
  However, the current compares are tied to the main IsVulnerable and don’t allow reusing them.

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[github-actions]

📊 API Changes Detected

Semver impact: major

github.com/aquasecurity/trivy/pkg/detector/library/compare/maven
  Incompatible changes:
  - Comparer.IsVulnerable: removed
  Compatible changes:
  - Comparer.MatchVersion: added

github.com/aquasecurity/trivy/pkg/detector/library/compare/generic
  Compatible changes:
  - Comparer: added

github.com/aquasecurity/trivy/pkg/detector/library/compare/pep440
  Incompatible changes:
  - Comparer.IsVulnerable: removed
  Compatible changes:
  - Comparer.MatchVersion: added

github.com/aquasecurity/trivy/pkg/detector/library
  Compatible changes:
  - (*Driver).IsVulnerable: added

github.com/aquasecurity/trivy/pkg/detector/library/compare/bitnami
  Incompatible changes:
  - Comparer.IsVulnerable: removed
  Compatible changes:
  - Comparer.MatchVersion: added

github.com/aquasecurity/trivy/pkg/detector/library/compare/npm
  Incompatible changes:
  - Comparer.IsVulnerable: removed

github.com/aquasecurity/trivy/pkg/detector/library/compare
  Incompatible changes:
  - Comparer.IsVulnerable: removed
  - Comparer.MatchVersion: added
  - GenericComparer: removed
  - IsVulnerable: removed

github.com/aquasecurity/trivy/pkg/detector/library/compare/rubygems
  Incompatible changes:
  - Comparer.IsVulnerable: removed
  Compatible changes:
  - Comparer.MatchVersion: added

[DmitriyLewen]

Here’s a more detailed description of the issue in #9427.
It’s related to an npm package.
Suppose we have a package with version 4.17.20+root.io.1 and an advisory:
• PatchedVersions: "4.17.20+root.io.5", "4.17.21"
• VulnerableVersions: "=4.17.20", ">4.17.20, <4.17.21"

When we check VulnerableVersions, the package is considered vulnerable.
But when we check PatchedVersions, 4.17.20+root.io.1 == 4.17.20+root.io.5 (because build metadata isn’t compared), so we don’t show this vulnerability.
Test for this case:
https://github.com/chait-slim/trivy/blob/790eaa7a430f9b95370d9a13695174b13c09b6d3/pkg/detector/library/rootio/rootio_test.go#L123-L154