ecr-assets: incomplete .dockerignore support

### Describe the bug

When creating a `DockerImageAsset` based on a directory with a `.dockerignore` file, the ignore list is not parsed correctly in some cases.

The build fails because some of the files that is explicitly whitelisted in the `.dockerignore` file have been excluded when the files where copied into the `cdk.out` asset folder.

I can see that the whitelisted directories and root-level files are correctly copied, e.g. `Cargo.toml` and the `crates` directory, but the whitelisted files that are in subdirectories, e.g. `docker/startup.sh`, are not copied into the build folder.

### Expected Behavior

The `.dockerignore` file works fine if I just run `docker build .` in the original source directory.
That is what I expect to happen in the `cdk.out` asset folder as well.

### Current Behavior

When the `.dockerignore` file uses the pattern of "exclude everything, include specific files",
only whitelisting of full directories or root level files work.

### Reproduction Steps

I am building an asset based on this [Dockerfile](https://github.com/Hirevo/alexandrie/blob/6e0b9019f30247006d16e13599c022c2e2f7a449/Dockerfile), and this [.dockerignore](https://github.com/Hirevo/alexandrie/blob/6e0b9019f30247006d16e13599c022c2e2f7a449/.dockerignore).

My code uses the following snippet to build the image:
```typescript
const alexandrieBaseImage = new ecrAssets.DockerImageAsset(this, 'AlexandrieBaseImage', {
directory: path.join(__dirname, '..', '..', 'alexandrie'),
buildArgs: {
DATABASE: "sqlite"
}
});
```

### Possible Solution

_No response_

### Additional Information/Context

This seems to have been an issue earlier as well in bug https://github.com/aws/aws-cdk/issues/4450

### CDK CLI Version

2.27.0 (build 8e89048)

### Framework Version

2.27.0

### Node.js Version

16.13.2

### OS

Linux x86

### Language

Typescript

### Language Version

3.8.3

### Other information

_No response_

Start at DockerImageAsset asset staging and compare its .dockerignore handling with docker build using the linked Dockerfile and .dockerignore. Reproduce with the provided TypeScript snippet, checking whether docker/startup.sh and other explicitly whitelisted nested files appear in cdk.out. Done means the staged context preserves the same whitelist behavior and the image build succeeds.

Written by the indexing model from the issue text.