fix: use loose semver to eliminate unnecessary errors

[Speedrunyourknowledge]

I recently used patch-package in production, and I got the “Version string cannot be parsed” error because one of my npm packages had the version 0.10.1a in its package.json. Specifically, this was the “mathquill” npm package. The “a” at the end of the version number was causing the error. As a result, patch-package was unable to patch this npm package when doing a fresh npm install and postinstall.

I propose using the “loose” option when checking if the semantic version of an npm package is valid. In my tests using the “loose” option, the mathquill npm package with version 0.10.1a was correctly given a patch with version 0.10.1-a.