feat(rules): add OS-independent glob matching to module rules - #21771

Compile the pattern segment-wise so a `*`, `?` or class stays inside one
segment, a whole-segment `**` spans segments, and neither crosses a dot
segment — what `path.matchesGlob` does. A leading `]` is a class member
again, and `.` segments and repeated separators collapse.

The corpus test drives 70 patterns over 67 paths and compares every pair
against `path.matchesGlob` (`path.win32` where a `\` is involved, since
that is the reading webpack normalizes to). Extended globs (`+(a|b)`)
are the one construct not implemented.

`glob` sits next to `test` / `include` / `exclude` and matches the
resource, so the common case needs no condition object:

    { glob: ["src/**/*.css", "!**/*.module.css"], use: [...] }

Patterns are OR-ed, a `!` prefix subtracts (the spelling `import.meta.glob`
and context modules already use), and a list of only `!` patterns subtracts
from everything. Every condition on a rule still has to match, so `glob`
combines with `test`, `include` and `exclude` rather than replacing them.

`path.matchesGlob` judges one pattern, so it says nothing about how a list
and its `!` entries combine. `fs.globSync` does: the case list runs over a
real file tree and compares the files the condition selects with the files
Node's glob walks to, `!` patterns subtracted the way `fs.glob`'s own
`exclude` option subtracts them.

`?(a|b)`, `*(a|b)`, `+(a|b)`, `@(a|b)` and `!(a)` now compile, the last as
a lookahead over what the rest of the segment matches, so `!(a).js` reads
as "not exactly a" and matches `ab.js`. A group that can match nothing
lets a literal dot through after it (`*(a).b` matches `.b`), which is what
decides the dot rule for the segment.

The corpus test grew the extended patterns and now runs 89 patterns over
86 paths with no divergence from `path.matchesGlob`. Guarding the
separator rewrite with a scan takes ~20% off a match on a path that has
none (98.7µs vs 125.8µs per 1000, medians of 5 interleaved rounds).

A group that quantifies matches nothing, so `!(x)/a` matches `/a` and
`a/!(x)` matches `a/` — what `path.matchesGlob`, minimatch, picomatch,
micromatch and POSIX `fnmatch(3)` all say. `@(a|)` and a bare `*` still
need a segment, as in Node and minimatch.

The corpus test grew the empty-segment and class cases (96 patterns over
93 paths), and the POSIX reading of classes, `?` and extended globs is
spelled out in its own case, each expectation checked against
`fnmatch(3)` under FNM_PATHNAME | FNM_PERIOD | FNM_EXTMATCH.

The list case built a temporary file tree and asked `fs.globSync` what it
found; `path.matchesGlob` answers the same question about the patterns
themselves, so the case is now pure string matching — no filesystem, no
temporary directory, and one oracle across both test files. It gained the
class and extended-glob lists while it was being rewritten.

`path.matchesGlob` runs minimatch's level-two optimization over both sides,
which drops `.` and empty segments and resolves `..` against the segment
before it (`**/..` excepted). Only the pattern got that here, so a path
carrying a `.` segment matched nothing — `/a/./b.js` did not even match
itself.

Both sides now go through one optimizer. The path pays for it only when a
scan finds a `//`, `/./` or `/../` to lose, so a normalized path still
costs one regexp test on the way in.

Resolving `..` textually is what `path.matchesGlob` does — it shares the
matcher `fs.glob` walks with, and that one asks minimatch for the
optimization a walker wants. Through a symlink the two disagree with the
kernel: `dir/link/../b.js` reads the `b.js` beside the link's target, while
the matcher reports it as `dir/b.js`, a different file. minimatch's own
default, picomatch, globby, tiny-glob and POSIX `fnmatch(3)` all leave `..`
alone, so it is matched as any other segment name here.

The `.` and empty segments keep collapsing: a `.` is the directory itself
whatever it is reached through, so those are safe.

`path.matchesGlob` builds its matcher through the helper `fs.glob` shares,
which sets `nocase` from the host rather than from the path flavour, so
`path.posix.matchesGlob("A.CSS", "*.css")` is false on Linux and true on
macOS and Windows. 36 pairs of the corpus rode on that and would have
failed the case for anyone not on Linux.

The corpus is lowercase throughout now, and case sensitivity — ours is
absolute — has a case of its own.

Six lines above the corpus, one per construct the glob tools read
differently, each with the reason this one reads it the way it does — so
the next person to compare webpack against minimatch, picomatch, globby or
tiny-glob finds the answer next to the cases rather than in a pull request.

`hasRuleForResource` counts a rule as handling `.css` when one of its globs
names the extension, so `glob: ["**/*", "!**/*.css"]` — which excludes css —
kept the built-in css type off. A `!` pattern subtracts, so it is no evidence.

Also covers the nested extended globs and the `./` path collapse that had no
case, and reuses the shared path regexps in the test oracle.

The five scanners that skip over a character class — brace expansion and
the three extended-glob scanners — stopped at the first `]`, so the class
in `@([]|]|c)` ended early and its `|` split the alternatives. glibc
`fnmatch(3)`, bash and `path.matchesGlob` all match `|` there; we did not.

One helper now does the skipping for all of them, with the same leading-`]`
and escape rules the class compiler already used.

The regexp compiler kept its own copy of the class scan the shared helper
now does; only the negation and the escaping of the body are its own.

Two camps disagree on `{a,[b,c]}`: `braces` — and so micromatch, picomatch
and fast-glob — reads the `,` in the class as a member and splits into `a`
and `[b,c]`, while bash expands braces textually before globbing and
minimatch, so `path.matchesGlob`, follows it into `a`, `[b` and `c]`.

webpack's expansion backs `import.meta.glob` and `require.context`, whose
patterns are written against the first, which is also what it has always
done. Now it is stated, in the expander's own contract and as cases at both
the context-module and the rule matcher.

Bun ships its own engine under that name, and it is a different one: 629 of
the corpus's 9,310 pairs disagree with it, mostly over the dot rule, `//`
and a trailing `/`. Node's agrees on all 9,310. So the parity cases ran
against whichever glob the runtime happened to have, and the `runtimes (bun)`
job failed on five of them.

They are Node-only now, and the three assertions that quote what
`path.matchesGlob` answers where this matcher deliberately differs moved out
of the behaviour cases into one of their own, so what is left says only what
this matcher does and runs everywhere.

The Bun job installs `bun-version: latest`, so 1.4.0 landed in CI with no
commit and turned 32 tests red across every open pull request. Four causes,
three of them cases asserting something that was never true off the main
thread:

- `Defaults.unittest` restored the cwd unconditionally, and `process.chdir`
  throws in a worker thread. Nothing moves it there, so only restore it when
  it actually moved.
- The wasm MIME-fallback cases gated on `Response`, which Bun 1.4.0 newly
  exposes to the jest environment, but what they need is
  `WebAssembly.instantiateStreaming` / `compileStreaming` — absent under
  `bun --bun`, so the runtime takes its non-streaming path and the fallback
  they are about is unreachable. Gate on the streaming compilers instead.
- `output-module-external` required `trace_events`, which throws "Trace
  events are unavailable" off the main thread on Node too; Bun 1.3.x was the
  outlier in allowing it. It joins the builtins the case already treats as
  optional, gated on a probe rather than on the engine.
- The universal worker cases are a Bun 1.4.0 regression: the harness's fake
  web `Worker` boots its eval worker and imports the emitted chunk, then
  exits with code 1 before delivering a message. Skipped on Bun, as three
  cases already are for other Bun defects.

Every case still runs on Node, where none of the four conditions hold.