fix(flags): reject leading-zero semver values in local evaluation

[dmarticus]

💡 Motivation and Context

Per semver 2.0.0 §2, numeric identifiers MUST NOT include leading zeros. Values like 1.07.3 or 01.2.3 are not valid semver — the local feature flag evaluator currently parses them silently (via the /^\d+$/ regex + to_i, so "07".to_i → 7), which means a person property of 1.07.3 would incorrectly match a semver_eq condition against 1.7.3.

This PR makes the parser reject leading zeros in numeric identifiers. Both override values and flag values are validated; invalid inputs raise InconclusiveMatchError so the condition simply does not match.

This mirrors the same fix already shipped in posthog-python (#601), posthog-go (#200), posthog-rs (#112), posthog-js/node (#3643), posthog-php (#147), posthog-dotnet (#206), and posthog-android/posthog-server (#521).

Changes

• parse_semver now uses a new parse_semver_numeric helper that rejects empty, non-digit, and leading-zero strings (except literal "0").
• semver_wildcard_bounds uses the same helper, so 01.* and 1.07.* are rejected.
• Inverted the existing edge-case test that previously asserted 01.02.03 matched 1.2.3 — it now correctly rejects.
• Added new tests covering override values (01.2.3, 1.02.3, 1.2.03, 1.07.3, 001.2.3), flag values across semver_gt / semver_caret / semver_tilde / semver_wildcard, and that literal 0 components (0.1.0, 1.0.0, 0.0.0) still match.

💚 How did you test it?

• bundle exec rspec spec/posthog/feature_flag_spec.rb -e "semver" — 21 examples, 0 failures
• bundle exec rspec — full suite passes (one pre-existing timing-flaky test in send_worker_spec, passes in isolation, unrelated to this change)
• bundle exec rubocop lib/posthog/feature_flags.rb spec/posthog/feature_flag_spec.rb — clean

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm changeset to generate a changeset file
• Added the release label to the PR