Fix `meteor update` from an app created from a checkout
Allow more than one dash in package version names

This is consistent with the semver spec, and should fix