Support arbitrary package version ranges

The security team is investigating adding a range test. We need to ensure our model can accommodate lower and upper versions and endpoints.