Exclude doesn't support individual resources

AFAIK there is no way to exclude just one resource (individual VM or instance) using the `exclude` parameter: is this expected ?

E.g: I tried the following in a rule to prevent public IPs on CloudSQL, but the exclude is not working:

```
match:
target: ["organization/*"]
exclude: ["//cloudsql.googleapis.com/projects//instances/my-db"]
```

or

```
match:
target: ["organization/*"]
exclude: ["organization//folder//project//cloudsqlinstance/"]
```

but excluding on the project level works (but might be inadequate for certain contexts):
```
match:
target: ["organization/*"]
exclude: ["organization//folder//project/"]
```