CVE-2021-43307: Regular expression denial of service in semver-regex

The vulnerability stems from the regex pattern returned by semverRegex() in index.js. The commit diff shows critical additions of lazy quantifiers (? modifiers) to {0,100} ranges and other groups, which directly addresses catastrophic backtracking. The added test case in test.js specifically measures execution time when testing ReDoS-prone patterns like '0.0.1-...', confirming the regex's test() method was vulnerable. Since semverRegex() is the sole function generating the regex pattern, and the patch exclusively modifies this function's output, it is conclusively identified as the vulnerable component.