Fix npm.py bug

[sbs2001]

Signed-off-by: sbs2001 shivam.sandbhor@gmail.com

Possibly fixes #126

Also implements the following logic and prevents the behaviour given below.

Unaffected version is that version which is in the fixed_version_range or which is absent in the aff_version_range

Before patch:

>>> import npm
>>> z=npm.extract_versions('ldapauth',"<=2.2.4","<0.0.0")
>>> z
(['1.0.0', '1.0.1', '1.0.2', '2.0.0', '2.1.0', '2.2.0', '2.2.1', '2.2.2', '2.2.3', '2.2.4'], [])

After patch:

>>> import npm
>>> z=npm.extract_versions('ldapauth',"<=2.2.4","<0.0.0")
>>> z
(['1.0.0', '1.0.1', '1.0.2', '2.0.0', '2.1.0', '2.2.0', '2.2.1', '2.2.2', '2.2.3', '2.2.4'], ['2.3.0', '2.3.1'])

Here are some details regarding ldapauth package.

Link to ldapauth advisory here (check for id 19)