Time travel to the date of advisory publish time when importing

[sbs2001]

This PR gets us one step closer to #140 (comment)

High level working:

1. While parsing any advisory it obtains the publish date of it. Almost every importer does this atm.
2. Since each advisory contains version ranges, we need to resolve it. Normally we would fetch all versions of the package from respective API and resolve it. This PR instead changes improves *VersionAPI classes to instead accept a cutoff date, to partition the versions accordingly. Here's a simple snippet

In [3]: import asyncio 
   ...: import pytz 
   ...: from dateutil.parser import parse 
   ...:  
   ...: from vulnerabilities.package_managers import NpmVersionAPI, PypiVersionAPI 
   ...:  
   ...: api = PypiVersionAPI() 
   ...: asyncio.run(api.load_api(["django"])) 
   ...: cutoff_date = parse("2018").replace(tzinfo=pytz.UTC) 
   ...: api.get("django", cutoff_date) 
   ...:  
   ...:                                                                                                                        
Out[3]: 
{'new': { #These are after cutoff_date 2018
.........
  '1.11.14',
  '3.2.4',
  '3.2a1',
  '3.2b1',
  '3.2rc1'
},
 'valid': { # This are before 2018
  '1.2.6'
.......
  '2.0b1',
  '2.0rc1',
  '2.1a1'}}

Things to do

1. Don't use dictionary with new and valid keys, use a class. @pombredanne please help in naming these.
2. Ubuntu and Debian VersionAPI need a fix, the current source doesn't give ALL versions.

[pombredanne]

Thanks. See my comments inline for your consideration!

[pombredanne]

This code looks hard to read... we should have intermediate variable to avoid the nested complexity, possibly using generator expressions.

[sbs2001]

Tracking this in #492 .

Could you elaborate an approach there ?

[pombredanne]

What about using a purl instead owner_repo