feat/out-of-scope-globs-and-hint: Accept globs in outOfScope*Dirs and hint when configured dirs match nothing

[vedanthvdev]

Summary

• outOfScopeTestDirs / outOfScopeSourceDirs now accept Ant-style globs (api-test/**, **/api-test/**, {api,perf}-test/**) alongside the existing literal directory prefixes. Each list entry is classified per-entry, so migrating adopters can mix both shapes in the same config.
• affectedTest --explain now emits a Hint: line when out-of-scope dirs are configured but the out-of-scope bucket is empty — the silent-failure trap a real adopter hit on v1.9.13.

Why

security-service migrated to v1.9.13 with outOfScopeTestDirs = ['api-test/**']. That looked intentional but the matcher only did literal prefix comparison, so the glob was treated as a literal path, never matched anything, and an api-test-only MR escalated to the full unit-test suite. The pilot only noticed after watching a 30-minute CI run burn on an api-test-only branch.

This PR closes both halves of that failure mode:

1. Glob support so the config that users naturally reach for actually bites, with the literal-prefix branch preserving the boundary-aware semantics the README already documented (api-test never claims api-test-utils/...).
2. Silent-miss hint so the next time someone writes a glob that doesn't match, they see it on --explain instead of in CI scrollback.

Implementation notes

• Matchers are pre-compiled at PathToClassMapper construction (matches how ignorePaths are handled), so per-diff mapping stays O(files × matchers) rather than re-parsing config strings per file.
• Glob metachar detection is small on purpose (*, ?, [, {) — anything more exotic falls through to literal-prefix and fails closed (matches nothing), which is safer than inferring glob intent.
• Hint suppression rules: empty diff (nothing to diagnose), populated bucket (config is biting — nothing to say), zero-config install (user never opted in). Its rarity is itself a signal.

Test plan

• Unit tests: five new PathToClassMapperTest cases (glob at root, nested **/ glob, source-dirs symmetry, literal-prefix regression guard, name-prefix negative guard).
• Gradle tests: five new AffectedTestTaskExplainFormatTest cases (hint fires for each knob, stays silent on populated bucket / zero config / empty diff).
• ./gradlew check green end-to-end.
• Post-merge: cut release, bump security-service to the new version and swap its outOfScopeTestDirs back to glob shape to confirm end-to-end.

Doc updates

• README: reshaped the outOfScopeTestDirs block to show both shapes, flipped the worked example to the glob form (api-test/**) now that it works.
• README: added the Hint: paragraph under the --explain section.
• CHANGELOG.md: Unreleased entry for both changes.