Option to include prereleases when matching npm/cargo ranges

`VersionRange#contains?` in 2.0 gates matches on `prerelease_allowed?`, which only permits a prerelease version when at least one bound in the interval carries a prerelease tag. That matches node-semver's default and is right for dependency resolution, but security-advisory matching needs the opposite: if the vulnerable range is `< 3.0.0` and `1.7.0-alpha.2` exists, the alpha is affected.

```ruby
Vers.satisfies?("1.7.0-alpha.2", "< 3.0.0", "npm") # => false
```

node-semver exposes this as `includePrerelease: true`. An equivalent keyword on `Vers.satisfies?` (and threaded through `VersionRange#contains?`) would let callers opt in without changing the default.

Start at Vers.satisfies? and VersionRange#contains?, especially the existing prerelease_allowed? gate described in the issue. Trace the option between these entry points, preserve the current default behavior, and verify that opting in matches prerelease versions such as 1.7.0-alpha.2 against < 3.0.0.

Written by the indexing model from the issue text.