assertions: Allow to use wildcard when specifying constructPath of Annotations

### Describe the feature

Currently we can use methods like [`Annotations.hasError`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.assertions.Annotations.html) for either 1. all the constructs or 2. one specific construct.

```ts
// 1. Find errors in every construct
Annotations.fromStack(stack).findError('*', 'foo');

// 2. Find errors in the specific path
Annotations.fromStack(stack).findError('/Stack/Some/Resource', 'foo');
```

Now it will be much more useful if we can specify more granular match like prefix match.

```ts
// Find errors under the specific path
Annotations.fromStack(stack).findError('/Stack/Some/Resource/*', 'foo');
```

### Use Case

I'd like to do more granular test on a specific construct. It would be ideal if we can use something like glob pattern to specify the construct path.

For example, when using with cdk-nag, we can check the vulnerabilities only for a specific construct and its children.

### Proposed Solution

Use [minimatch](https://github.com/isaacs/minimatch) library here instead of `v.id === path`. `minimatch` is already used in `aws-cdk-lib` so it should not affect bundle size.

https://github.com/aws/aws-cdk/blob/d99733f4689f991a27ff05389271d23447c05b93/packages/aws-cdk-lib/assertions/lib/private/messages.ts#L56-L58

However, because we can use special characters such as * or + in a construct id, the syntax of minimatch conflicts with them. We have to consider a workaround to introduce this feature without breaking changes.

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.81.0

### Environment details (OS name and version, etc.)

macOS

Start at packages/aws-cdk-lib/assertions/lib/private/messages.ts, especially the path comparison around the linked lines, and trace the Annotations.findError/hasError entry points. Review the existing assertion tests and minimatch usage; done means wildcard paths match the intended construct subtree without changing literal IDs containing glob characters.

Written by the indexing model from the issue text.