docs: document double-wildcard pattern for domain-level repository matching

[ArsalanAnwer0]

Summary

This PR addresses issue #26194 by documenting the existing support for double-wildcard (**) patterns in AppProject sourceRepos, enabling domain-level repository matching.

Problem

Users expected https://github.com/* to match all GitHub repositories, but the single wildcard (*) only matches within a single path segment due to the glob library using / as a separator. This created confusion and forced users to either:

• Use the overly permissive * pattern (matches all Git servers)
• Maintain large lists of individual organizations (unmaintainable at scale)

Solution

The gobwas/glob library already supports ** for recursive matching across path segments. This PR adds comprehensive documentation and test coverage to make this feature discoverable and well-understood.

Changes

1. Test Coverage: Added test cases demonstrating:

   • https://github.com/** matches all GitHub repositories
   • https://github.com/** does not match GitLab repositories
   • https://github.com/* does not match multi-level paths (clarifies expected behavior)
   • Negation patterns like !https://github.com/**
   • Combined patterns like allowing all except GitHub

2. Documentation: Enhanced user guide with:

   • Clear explanation of * vs ** wildcard behavior
   • Common pattern examples for GitHub, GitLab, etc.
   • Negation pattern examples
   • Multiple use cases (domain-level, org-level, nested paths)

3. Code Documentation: Added godoc comments to IsSourcePermitted() explaining:

   • Wildcard pattern syntax
   • Practical examples
   • Negation support

Examples

Now users can create policies like:

spec:
  sourceRepos:
    # Allow all GitHub repositories
    - 'https://github.com/**'
    
    # Deny all GitHub repos except specific org
    - '!https://github.com/**'
    - 'https://github.com/my-org/*'
    - '*'
    
    # Allow all GitLab nested subgroups
    - 'https://gitlab.com/group/**'

Impact

• Security: Enable "GitHub-only" or "GitLab-only" policies without using overly permissive *
• Scale: Platform teams with 50+ organizations can use a single pattern instead of 50+ entries
• Multi-tenancy: Create "sandbox" projects for experimentation scoped to a specific Git provider
• Consistency: All wildcard levels work predictably (*, **, org/*, etc.)

Testing

All existing tests pass, confirming backward compatibility. New tests verify:

• Domain-level wildcard matching with **
• Negation patterns with **
• Correct rejection of mismatched domains

Closes #26194

[bunnyshell]

✅ Preview Environment deployed on Bunnyshell

Component	Endpoints
argocd	https://argocd-s4ybzp.bunnyenv.com/
argocd-ttyd	https://argocd-web-cli-s4ybzp.bunnyenv.com/

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🔴 /bns:stop to stop the environment
• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment