Update repository specification with info about the 'affected[].versions' fields in advisories (#4191)

doc/repository-spec-v2.md

diff --git a/doc/repository-spec-v2.md b/doc/repository-spec-v2.md
index 166eb47..0a1a1c4 100644
--- a/doc/repository-spec-v2.md
+++ b/doc/repository-spec-v2.md
@@ -424,6 +424,11 @@
 format](https://ossf.github.io/osv-schema/). The list is empty, if
 no security advisory affects this package.
 
+The `affected[].versions` field within a security advisory must be present and
+fully populated by a hosted pub-server that provides advisories. Hence, the
+`dart pub` client will exclusively rely on `affected[].versions`, and disregard
+`affected[].ranges`.
+
 The `advisoriesUpdated` property is the most recent timestamp of when the result
 from this end-point for this package changed. This can be used for caching
 purposes.