When using glob(), Bazel should ignore excluded files when deciding about re-analysis

### Description of the bug:

When using glob() with an exclude pattern, Bazel invalidates and rebuilds actions whenever a file that matches the exclude pattern is changed or added, even if the resulting set of source files remains unchanged. This leads to unnecessary re-analysis.

### Which category does this issue belong to?

_No response_

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Prepare the following project files:

BUILD.bazel

```starlark
genrule(
name = "genrule",
outs = ["hello_generated.c"],
srcs = glob(["*.c"], exclude = ["*_generated.*"]),
cmd = "cp $< $@",
)

cc_binary(
name = "hello_generated",
srcs = [":genrule"],
)

```

hello.c

```c++
#include

int main() {
printf("Hello World\n");
return 0;
}

```

**Initial build**
bazel build //:hello_generated
```shell
Output:
INFO: Analyzed 2 targets (3 packages loaded, 25 targets configured).
```

**Second build without changes:**
bazel build //:hello_generated
```shell
Output:
INFO: Analyzed 2 targets (0 packages loaded, 0 targets configured).
```

**Adding a file whose name matches the exclude pattern in a glob() (e.g., *_generated.*):**
touch foo_generated.c
Build again:
bazel build //:hello_generated
```shell
Output:
INFO: Analyzed 2 targets (1 packages loaded, 3 targets configured).
```

**Actual Behavior**
The build is invalidated and actions are re-executed, even though the set of actual inputs to the rule (srcs) has not changed.

**Expected Behavior**
Since foo_generated.c matches the exclude pattern, Bazel should not re-analysis.

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

release 8.2.0

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with the BUILD.bazel reproduction and run the three bazel build //:hello_generated scenarios, including adding foo_generated.c. Trace how glob() exclusions affect package loading and re-analysis. Done means changing an excluded file no longer reloads the package or re-executes actions when the source set is unchanged.

Written by the indexing model from the issue text.