Strip RSR suffixes prior to handing off OS version from Nudge check to Semver comparison (#22830)

#22829

Fixes 500s in config endpoint when a machine with an RSR version
installed is in a team with enforced macOS updates

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [ ] Manual QA for all new/changed functionality

server/fleet/operating_systems.go

@@ -2,6 +2,7 @@ package fleet
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 
 	"github.com/Masterminds/semver"
@@ -34,6 +35,7 @@ func (os OperatingSystem) IsWindows() bool {
 }
 
 var macOSNudgeLastVersion = semver.MustParse("14")
+var macOSRapidSecurityResponseVersionSuffix = regexp.MustCompile(` \([a-z]\)`)
 
 // RequiresNudge returns whether the target platform is darwin and
 // below version 14. Starting at macOS 14 nudge is no longer required,
@@ -43,7 +45,8 @@ func (os *OperatingSystem) RequiresNudge() (bool, error) {
 		return false, nil
 	}
 
-	version, err := semver.NewVersion(os.Version)
+	// strip Rapid Security Response suffix (e.g. version 13.3.7 (a)) if any
+	version, err := semver.NewVersion(macOSRapidSecurityResponseVersionSuffix.ReplaceAllString(os.Version, ``))
 	if err != nil {
 		return false, fmt.Errorf("parsing macos version \"%s\": %w", os.Version, err)
 	}

server/fleet/operating_systems_test.go

@@ -35,8 +35,12 @@ func TestOperatingSystemRequiresNudge(t *testing.T) {
 		{platform: "darwin", parseError: true},
 		{platform: "darwin", version: "12.0.9", requiresNudge: true},
 		{platform: "darwin", version: "11", requiresNudge: true},
+		{platform: "darwin", version: "13.3.1 (a)", requiresNudge: true},
+		{platform: "darwin", version: "13.4.1 (c)", requiresNudge: true},
 		{platform: "darwin", version: "14.0"},
 		{platform: "darwin", version: "14.3.2"},
+		{platform: "darwin", version: "15.0.1"},
+		{platform: "darwin", version: "15.0.1 (a)"},
 		{platform: "windows"},
 		{platform: "windows", version: "12.2"},
 		{platform: "windows", version: "15.4"},