Fix universal package version validation comment and add SHA prefix (#28248)
### Description
<!-- Describe your changes. -->
- Correct misleading 'SemVer 1.0.0' label; the universal version regex
actually validates SemVer 2.0.0 syntax without build metadata, which is
what Azure Universal Packages requires.
- Prefix the dev short SHA with 'commit-' in universal_version so the
pre-release identifier always contains a non-digit, avoiding spurious
validation failures for all-numeric SHAs with leading zeros.
### Motivation and Context
<!-- - Why is this change required? What problem does it solve?
- If it fixes an open issue, please link to the issue here. -->
Fix invalid version when we have an all-numeric commit SHA starting with
0.