pkg_ref alters semantic versioning of source packages

[Gotfrid]

Some packages on CRAN follow x.y-z semantic versioning convention, for example sf, abind.

riskmetric::pkg_ref changes the semantics to be x.y.z due to the usage of base::package_version() specifically when working with the source packages.

I think it is conceptually not ideal, because later it is not possible to join assessment data with the original package DESCRIPTION meta info.

I am opening this issue to understand better why the line of code linked above is necessary, and why can't we use a string representation of the version. I am definitely missing some broader context here.

My initial thought was version comparisons, but it works fine with the standard library function:

version_old <- "1.1-1"
version_new <- "1.1-2"
utils::compareVersion(version_new, version_old)

cc @llrs-roche

[emilliman5]

This looks benign to me as well. Please feel free to create a PR, I would be happy to review it.