Pass the `loose` flag to semver.parse() so it handles malformed input.

fixbuild() might still need to be more flexible, but this single change
addresses dominictarr/npmd#30 (at least, my npmd sync is still chugging
along many minutes later).

Wrote a unit test with a couple of sample malformed version strings.