…check

Fixes #6514

The check introduced in #6453 used a substring 'not in' test to compare
the required Python version (from Pipfile [requires]) against the actual
Python version. This produces false-negatives (silently accepting an
incompatible interpreter) whenever the required version string happens to
be a substring of the actual version string.

Concrete example from the issue:

  required  = "3.11"     (python_version in Pipfile.lock)
  actual    = "3.13.11"  (system Python in the Docker image)

  "3.11" in "3.13.11"  →  True   ← wrong: they are NOT compatible
  ("3.11" matches characters 3-6 of "3.13.11")

This silently skipped the incompatibility warning/error, so
'pipenv install --deploy --system' succeeded when it should have aborted.

Fix: replace the substring check with proper semantic version comparison
via packaging.version.parse (already imported in the module):

  * When required_python_version has only two dot-separated components
    (i.e. python_version = "X.Y"), compare only the major and minor
    fields of the parsed versions.
  * When it has three or more components (python_full_version = "X.Y.Z"),
    require an exact match.

The comparison is extracted into a module-level helper function
_python_version_matches_required() to keep ensure_project() readable and
to allow direct unit testing.

Tests: 19 parametrised cases added in TestPythonVersionMatchesRequired,
covering the exact substring-trap from the issue, additional ambiguous
pairs ("3.9"/"3.9.10", "3.1"/"3.11.0", "3.11.1"/"3.11.10"), major-version
mismatches, python_full_version exact-match and mismatch cases, and
empty-string edge cases.