improvements to semver handling

1. make exact tags work, i.e. `npm/npm@rplockfix` should return that tarball, not fail, even though it isn't a version
2. make loose semver work, i.e. `visionmedia/npm@3.0.1` should return `3.0.0rc3`
3. always return highest matching version, not the first one
4. tests for anything listed above