[deckhouse-cli] download only latest patches

[ldmonster]

Problem

d8 mirror pull --include-module [email protected] pulled every patch in the matched
semver range (8 version tags × channel aliases = 13 pulls per module). The root
cause was that Filter.VersionsToMirror returned every tag that satisfied the
semver constraint without any per-minor deduplication.

Closes #220.

Solution

Apply a latest-patch-per-minor filter to versions matched by ^, ~, and
range constraints — mirroring the platform release-discovery rule
(filterOnlyLatestPatches in internal/mirror/platform/platform.go).

Anchor exception

Versions explicitly named with an inclusive boundary operator (>= or <=)
are always preserved, even when a newer patch exists in the same minor.

>=1.40.0 literally encodes "v1.40.0 OR newer" — the equality is part of the
operator and silently dropping the named boundary in favour of a later patch
would override an explicit user request. Only >= and <= create anchors;
strict bounds (>, <) and shorthand operators (^, ~) do not.

Anchors that are absent from the registry are skipped — no tag is ever invented.

Behaviour table

Constraint	Registry has v1.40.0, v1.40.1	Result
[email protected] / ^1.40.0	yes	v1.40.1 only (issue #220 case)
module@~1.40.0	yes	v1.40.1 only
module@>=1.40.0	yes	v1.40.0, v1.40.1 (anchor preserved)
module@>=1.40.0 <=1.42.5	yes	v1.40.0, v1.40.1, …, v1.42.5
module@>1.40.0	yes	v1.40.1 only (strict — no anchor)
module@=v1.40.0	yes	v1.40.0 only (exact)

Changes

• internal/mirror/modules/constraints.go — SemanticVersionConstraint now
  carries an anchors field populated by scanning >=/<= sub-expressions
  in the raw constraint string via extractInclusiveAnchors.
• internal/mirror/modules/filter.go — VersionsToMirror applies
  filterOnlyLatestPatches then calls restoreInclusiveAnchors to re-add any
  anchor that was collapsed by the per-minor filter.
• internal/mirror/modules/filter_test.go — 7 new unit test cases covering
  >= anchor preservation, <= anchor, strict > non-anchor, caret
  non-anchor, missing-anchor skip, and the >=/<= combined case.
• internal/mirror/modules/pull_modules_test.go — updated integration tests +
  new bare >= preserves anchor row in
  TestPullModules_SemverConstraintPullsAllMatchingTags.
• internal/mirror/cmd/pull/flags/flags.go + internal/mirror/README.MD —
  documented the anchor rule and updated examples.