appspec.yml pattern and exclude file globs

It would be great if the `pattern` and `exclude` keys accepted bash file globs and worked properly across sub directories. For example, I have a Symfony4 app that looks like:

```
bin/
console
config/
services.yaml
public/
index.php
src/
MyController.php
templates/
my_template.html.twig
```

I want all directories to have mode `750` and all files to have mode `640`. Except for the `bin/console` file which needs mode `750`.

This is the config that I've tried in `appspec.yml`:
```yml
version: 0.0
os: linux

files:
- source: /
destination: /srv/www/app/

permissions:
- object: /srv/www/app
owner: ubuntu
group: www-data
mode: 750
type:
- directory
- object: /srv/www/app
pattern: '**'
except:
- bin/console # also tried 'console' and 'bin/*' and '/srv/www/app/bin/console'
owner: ubuntu
group: www-data
mode: 640
type:
- file
- object: /srv/www/app/bin
owner: ubuntu
group: www-data
mode: 750
type:
- file
```

But I get the following error:
```
The deployment failed because the permissions setting for (/srv/www/app/bin/console) is specified more than once in the application specification file. Update the files section of the AppSpec file, and then try again.
```

I can't seem to find a value which I can put in the `except` key that successfully excludes the `bin/console` file. If it supported bash file globs you could easily do something like `bin/*` because all the files in the bin directory are going to need different permissions.

Start by reproducing the deployment with the provided appspec.yml, focusing on the permissions entries and their pattern and except keys. Trace how the agent matches files across subdirectories and handles overlapping permission rules. Done means bash-style globs work consistently and bin/console is excluded without a duplicate-permissions error.

Written by the indexing model from the issue text.