Specificity matching is breaking the ability to group major updates by ecosystem

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

11.12.0

### Language version

24.15.0

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

[dependabot.yml](https://github.com/user-attachments/files/27334623/dependabot.yml)

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

My goal is to have 3 types of update PRs:

- group major updates of the same ecosystem in the same PR
- Note: by ecosystem, I mean packages that are usually released together and should be updated at the same time.
For instance, all `@nestjs/*` packages, all `@graphql-codegen/*` packages, etc…
- group all minor & patch updates in another PR
- open an individual PR for major updates that are not part of an ecosystem

To do this, I define groups for major updates in the same ecosystem, then one group for all minor & major, then expect the remaining major updates to fall through and not be grouped. See below for the smallest reproducible config.

The problem is that the "specificity" feature is ignoring the filters that groups may have, so `update-types` gets completely ignored.

Let's take the two PRs that dependabot just opened on my repo:

If I look at the logs, I get this:

```
updater | 2026/05/04 05:27:25 INFO Checking specificity for @graphql-codegen/cli in group 'graphql-codegen' (applies_to: version-updates)
updater | 2026/05/04 05:27:25 INFO Skipping @graphql-codegen/cli for group 'graphql-codegen' - belongs to more specific group 'minor-and-patch'

updater | 2026/05/04 05:27:25 INFO Checking specificity for @graphql-codegen/client-preset in group 'graphql-codegen' (applies_to: version-updates)
updater | 2026/05/04 05:27:25 INFO Skipping @graphql-codegen/client-preset for group 'graphql-codegen' - belongs to more specific group 'minor-and-patch'
```

These two packages that should have been grouped together will always ignore my `graphql-codegen` group, because it uses the `*` character in its pattern

It actually gets worse, because if I add the `*` pattern to the `minor-and-patch` group, now the specificity will always ignore `minor-and-patch` for all graphql-codegen packages 🥲

Please give us a way to opt out of this specificity check

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

```yaml
version: 2
updates:
- package-ecosystem: 'npm'
directory: '/'
schedule:
interval: 'weekly'
day: 'monday'
time: '05:00'
timezone: 'UTC'
labels:
- 'npm'
groups:
# Packages
graphql-codegen:
applies-to: version-updates
update-types:
- 'major'
patterns:
- '@graphql-codegen/*'

# Every other minor + patch bump is batched into one PR.
# Major bumps that don't match any group above each get their own PR.
minor-and-patch:
applies-to: version-updates
update-types:
- 'minor'
- 'patch'
```