Support glob patterns in ignoreDependencies #2953

Problem

ignoreDependencies matches package names by exact string equality only (as documented in schema.json). A monorepo that needs to ignore a whole scope has to list every package by name, and the list must be updated each time a workspace package is added.

A glob-looking entry is accepted silently and has no effect, so the mistake is easy to miss:

{ "ignoreDependencies": ["@repro/*"] }

$ fallow dead-code
● Unused dependencies (1)
  @repro/lib (packages/app/package.json)

Only the exact name "@repro/lib" works in this case (fallow 3.30.0).

knip accepts regex in ignoreDependencies (we used "@acme/.+" before migrating), and fallow migrate drops such entries with a warning (migrate_knip_regex_ignore_deps_skipped in crates/cli/src/migrate/knip.rs). The migrated config therefore no longer applies these exclusions.

Proposed solution

Accept glob patterns in ignoreDependencies, with the same glob syntax as ignorePatterns and ignoreExports[].file:

{ "ignoreDependencies": ["@acme/*", "@types/*"] }

• Entries without glob metacharacters keep the current exact-match behavior, so existing exact-name configs are unaffected.
• fallow migrate could then convert simple knip regexes such as "@org/.+" to "@org/*" instead of dropping them.
• A warning for a pattern that matches no declared dependency (or reporting it through stale-suppressions) would help catch typos.

Alternatives considered

• Listing every package by name. We currently maintain 26 @acme/* names in ignoreDependencies.
• An overrides entry that turns off unused-dependencies for the affected packages. This also hides real unused third-party dependencies in those packages, so it is too broad.

Related bug

Our immediate use case is #2952: workspace dependencies reached only through package.json imports aliases are reported as unused. The glob request would reduce the maintenance cost of the workaround; fixing the alias bug would remove the need for that workaround.

Even after that bug is fixed, a scope-level ignore stays useful for packages that are loaded by name at runtime.