Wildcard support for ignore lists and improved deletion safety

**Is your feature request related to a problem? Please describe.**
In enterprise AWS environments, it is common to have numerous system-managed groups (e.g., those created by AWS Control Tower, Account Factory, or Lake Formation) typically prefixed with `AWS...`.

Currently, `ssosync` only supports **exact string matching** for the `ignore_groups` and `ignore_users` parameters. This makes configuration brittle and high-maintenance, as every new system-generated group must be manually added to the configuration to prevent accidental deletion during the "mirroring" process.

**Describe the solution you'd like**
1. **Wildcard Support**: Implement glob-style wildcard matching (e.g., `AWS*`, `*@consultant.com`) for both `ignore_groups` and `ignore_users`. This would allow users to protect entire namespaces of groups or users with a single entry.
2. **Improved Deletion Safety**: Ensure that the synchronization logic (specifically in `groups` mode) strictly filters AWS objects against the ignore list *before* they are added to the deletion queue, providing a more robust safety net for manual or legacy AWS objects.

**Describe alternatives you've considered**
The only current alternative is to manually maintain a long list of exact group names. This is error-prone and often leads to accidental deletions when new AWS service groups are automatically created by AWS or others users in the background.

**Additional context**
I have checked the `internal/sync.go` and identified that switching the exact string lookup in the Go map to a `path.Match` pattern would enable this functionality.

_I am preparing to fork the repository to implement these changes and would be happy to submit a Pull Request if this enhancement is welcome!_

Start in internal/sync.go and inspect the exact matching for ignore_groups and ignore_users, then trace the groups-mode deletion queue. Check how path.Match could represent the requested glob patterns and verify that ignored AWS objects are filtered before deletion. Done means both ignore lists support patterns such as AWS* and *@consultant.com without queuing matching objects for deletion.

Written by the indexing model from the issue text.