Automatically downgrade/fallback bundled signatures to next lower version if missing

[uschindler]

This fixes #273.

The code is in early stage, but works. I added a version comparator and a comparator for bundled-signatures names. The comparator may not be the fastest, but should work correctly.

[uschindler]

I think this is ready now, will merge soon. This improvement will allow the following:

• If a version of a versioned bundled signature (e.g., commons-io-unsafe-x.y) is not found it will try to find the next lower version and print a warning (e.g., versions searched is "2.10.1" instead of "2.10.0")
• If a version of a versioned bundled signature (e.g., commons-io-unsafe-x.y) is not found it will try to find the equivalent version and NOT print a warning (e.g, version searched is "2.10" instead of "2.10.0")

This allows to refer to newer commons-io versions than the ones released as bundled signatures. A warning is printed. This warning implicitely suggests to update forbiddenapis once a new version is available, but this is not clearly communicated to prevent users from opening issues and requesting new versions (hopefully).