Function glob_match

pub fn glob_match(pattern: &str, value: &str) -> bool

Glob match with * wildcard support.

Supports * (matches any sequence of characters, including empty). The match is greedy: it matches the longest possible prefix of the value against the literal prefix, then advances. This is sufficient for the resource-pattern use case in delegation tokens.

Implementation: a two-pointer walk that avoids both the recursion and the Vec<&str> allocation of the previous version. The *-delimited segments are matched left-to-right; on any partial failure we back up the segment pointer to the previous * position and try the next value position.