RFC: support recursive path pattern delegations

[cyphar]

At the moment, the wildcards supported by PATHPATTERN only allow you to match within one directory, but this is quite problematic if you want to delegate entire directory trees to a role. A fairly simple example where this would be particularly useful is if you use directories to represent projects which can then delegate to sub-projects -- the top-level delegator role would not know how the delegatee's structure looks in order to create a comprehensive PATHPATTERN, but all they would care about is the top-level directory.

The simplest proposal that matches the existing Unix glob-like semantics would be to allow for ** to act as a wildcard that matches / as well (many Unix tools support that as a special kind of glob). An alternative approach would be to allow for a PATHPATTERN to define a path prefix to match against, but ** is more generic.

Regardless of the approach taken, clients would likely need to gate this new matching behaviour based on the spec_version in root.json as otherwise they may start to misinterpret older repository data that inadvertently used ** instead of * for regular globbing.

[cyphar]

Kind of related to #208 (which probably deserves to be closed by now?).

[cyphar]

TAP 4 also makes this and #208 a little more confusing, because their concept of globbing makes * match /s as well which directly contradicts the behaviour of path patterns:

4.2. Otherwise, go back to step 1 and process the next mapping that matches the requested file. In figure 1, if the second mapping was not a match, or if none of its repositories signed metadata about foo-1.0.tgz, the third mapping will still match because its glob pattern is * (all requested files match).

Having an explicit recursive wildcard would allow both match patterns to actually work the same way.