fix(security-guidance): make ** glob patterns match zero-depth paths

[anishsamant]

_glob_match delegated to fnmatch, where a bare * already crosses '/', so /*.ts requires a literal '/' and silently excludes top-level files from security-patterns.json rules even though the docstring promises " matches any depth". Since these are security rules, the failure mode is silent non-coverage with no error — a rule that never fires looks identical to a rule that passed.

Replace it with a small glob-to-regex translator: **/ matches zero or more path segments (so **/*.ts matches both config.ts and src/a.ts), a bare ** matches any depth including /, and *, ?, [...] keep their existing fnmatch-equivalent meaning. The
basename fallback in _hit() is unchanged.

Verified

• config.ts and src/a.ts both match **/*.ts (previously only the latter did)
• utils/**/*.ts matches utils/x.ts, utils/sub/x.ts, and correctly excludes other/x.ts
• Plain *.ts still matches via basename fallback for nested paths
• include/exclude interaction (exclude_paths) still works as before

Fixes #86545