feat: test handling of ~= in requirements.txt and add it to docs

[ayushthe1]

fixes #3581 .

CVE binary tool can already handle version ranges specified with ~= in the requirements.txt file since it utilizes pip install --dry-run .

Whats added by this PR :

• a test showing this ability by adding a package to test_requirements.txt file with ~= and updating the test to make sure it's parsed.
• documentation mentioning that ~= in requirements.txt can be supported by cve-bin-tool

[terriko]

The test looks good. I think we could probably tell users a bit more in the docs, so I've added some suggested changes for you with some extra text.

[ayushthe1]

Thanks for the review @terriko. I've incorporated your suggestions.

[terriko]

Updating branch for the tests.

[codecov-commenter]

Codecov Report

Attention: 1 lines in your changes are missing coverage. Please review.

Comparison is base (f835f2c) 79.02% compared to head (8c3db2a) 79.11%.

Files	Patch %	Lines
test/test_package_list_parser.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3610      +/-   ##
==========================================
+ Coverage   79.02%   79.11%   +0.09%     
==========================================
  Files         799      799              
  Lines       11954    11954              
  Branches     1603     1603              
==========================================
+ Hits         9447     9458      +11     
+ Misses       2065     2058       -7     
+ Partials      442      438       -4     

Flag	Coverage Δ
longtests	73.86% <0.00%> (-0.04%)	⬇️
win-longtests	77.13% <0.00%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[terriko]

This test works, but adding a new dependency to test_requirements.txt and having to install it is going to make this test take longer than it needs to because it'll have to make another network request to install stuff. Can you switch this to use something we're already installing? e.g. it should work just as well if you edit one of the other lines instead of adding lua-cjson. Also, maybe now is a good time to change this test so there are only two things in test_requirements.txt if we're just testing == and ~=? No point in making more system churn if we don't need to. I'd suggest you remove html5lib because I hate their version numbering scheme and just make the test use httplib2 and requests.

[terriko]

Thanks! This looks like it'll do the trick and might even make things run a bit faster.