Add a "first_not_affected" field or similar to properly describe all possible ranges for affected packages

Description

Hi!

I was trying to express some NVD vulnerabilities with OSV.
They use these keywords for the ranges

• versionStartIncluding
• versionStartExcluding
• versionEndIncluding
• versionEndExcluding

So we can have these type of intervals

• [X,..., Y] : from X to Y, both ends included
• [X,..., Y) : from X to Y, X included, Y excluded
• (X,..., Y] : from X to Y, X excluded, Y included
• (X,..., Y) : from X to Y, both ends excluded

But here in OSV, we have:

• introduced: this is equivalent to versionStartIncluding
• fixed: this is equivalent to versionEndExcluding
• last_affected: this is equivalent to versionEndIncluding
• limit: in this context, it is similar to fixed

It isn't posible to express (X,..., Y] / (X,..., Y) ranges, we are missing an equivalen to versionStartExcluding.

Example

The https://nvd.nist.gov/vuln/detail/CVE-2022-34465 vulnerability has this type of ranges

Start with the OSV range semantics described in the issue and review the existing introduced, fixed, last_affected, and limit fields. Define how a lower-bound-exclusive range should be represented and verify that all four interval combinations can be expressed without ambiguity; done means the schema change and its compatibility implications are resolved.