pep440 versionfilter returns a pre-release when the pattern is a constraint #10545

Current Behavior

Pep440.Search skips pre-releases only in its ""/"*" branch (pep440.go:57-70). With a constraint pattern it returns the first specifiers.Check match from the descending list, so an in-range pre-release wins:

Searching for version matching pattern ">=15,<16"
✔ version "15.7.0b1" found for PyPI package "stripe"   # latest stable is 15.6.1

aquasecurity/go-pep440-version only excludes a pre-release that shares the specifier's base version (specifier.go:366-373); the general PEP 440 rule is left to the caller, as pip does in its finder.

This mostly bites the pyproject crawler, which reuses each dependency's own constraint as the pattern (dependencies.go:191-196), so constrained deps get pre-releases while unconstrained ones (pattern *) are fine. One run proposed stripe 15.7.0b1, pydantic 2.14.0b2 and SQLAlchemy 2.1.0rc2, alongside correct stables for idna and boto3.

Expected Behavior

Same rule as the wildcard branch: highest matching stable, pre-release only when no stable satisfies the constraint. Here 15.6.1.

Steps To Reproduce

# stripe.yaml
sources:
  stripe:
    kind: pypi
    spec:
      name: stripe
      versionfilter:
        kind: pep440
        pattern: ">=15,<16"

updatecli diff --config stripe.yaml
# ✔ version "15.7.0b1" found  → expected 15.6.1 ("*" returns 15.6.1)

Environment

• OS: macOS (darwin/arm64)
• updatecli: v0.120.1, also reproduced on main @ c1f2f28

Pipeline Graph

graph TD
    source#stripe(["stripe (pypi)"])

Anything else?

Fix direction: make the constraint branch two-pass like the wildcard one, preferring the highest matching stable and keeping the highest matching pre-release as fallback. Two open points:

1. pip allows pre-releases when the constraint itself names one (>=2.14.0b1 picks 2.15.0b1 over a stable 2.14.0). Preferring the stable is safer for an auto-bumper but diverges from pip.
2. Whether the pyproject crawler should additionally honour [tool.uv] prerelease (disallow / allow). uv can't enforce it against the generated target: uv lock --upgrade-package <pkg>==<pre-release> makes the pre-release necessary by construction under the default if-necessary.