feat(API): update version matching for NuGet, PyPI and RubyGems

[hogo6002]

Malicious package publishes OSV records for crates.io, npm, NuGet, PyPI, and RubyGems. Queries for NuGet, PyPI, and RubyGems (npm and crates.io use semantic versioning, so the matching process is different) only match vulnerabilities against specific affected versions. However, malicious package records may only provide affected ranges instead of individual versions in some cases (e.g. https://api.osv.dev/v1/vulns/MAL-2022-7426). OSV also can't enumerate affected versions for a malicious package as those versions have been deleted. This causes issues like #2407

Switching the API query version matching from _query_by_generic_version() to _query_by_comparing_versions() can address this issue. The _query_by_comparing_versions() function matches both affected versions and affected ranges, but might slow down the performance for a bit.

Adding this PR after the end-of-year release to give more time to verify performance on the test instance before rolling out to prod.

[another-rex]

Can you update the title to be more about switching the 3 ecosystems to the new matching method? While this change is motivated by improving Malicious package matching, the actual change will primarily affects normal matching as well (if I understand correctly), would be good to clarify that.