fix: reject loose ranges that collapse to match everything

In loose mode the comparators that fail to parse are filtered out of a
comparator list, and whatever is left becomes the range. When the only
survivor is the any comparator, a typo such as `* (4.1.x  4.1.2)` drops
`(4.1.x` and `4.1.2)` and collapses to the leftover `*`, so the range
silently satisfies every version instead of being rejected. Without
`loose` the same input throws `Invalid comparator: (4.1.x`.

Treat that comparator list as invalid instead, the same way a list with
no valid comparator at all is already treated: the list is dropped, so
other `||` branches still stand on their own and a range left with no
valid branch throws `Invalid SemVer Range`.

Junk sitting next to a comparator that does parse is still tolerated, so
`>=1.2.3 &&&` still yields `>=1.2.3` and `== 1.0.0` still yields
`1.0.0`.

Fixes #387

classes/range.js

@@ -143,10 +143,18 @@ class Range {
 
     if (loose) {
       // in loose mode, throw out any that are not valid comparators
-      rangeList = rangeList.filter(comp => {
+      const filtered = rangeList.filter(comp => {
         debug('loose invalid filter', comp, this.options)
         return !!comp.match(re[t.COMPARATORLOOSE])
       })
+      // dropping invalid comparators must not leave a range that matches
+      // everything: `* (4.1.x 4.1.2)` would collapse to the leftover `*`.
+      // if only the any comparator survives, treat the list as invalid.
+      if (filtered.length !== rangeList.length &&
+          filtered.every(comp => comp === '')) {
+        return []
+      }
+      rangeList = filtered
     }
     debug('range list', rangeList)