project-excludes applies too late

### Describe the Bug

project-excludes seems to be applied to late, when the global pattern is being resolved and it hits a symlink to a blocked path it fails, here's the smallest reproducable example that I could come up with:

1. make two new dirs
mkdir -p project/pkg blocked/subdir

2. block the path
chmod 000 blocked

3. make a symlink to blocked path
ln -s blocked project/pkg/excluded_link

4. inside pyrefly.toml add
project-excludes = ["project/pkg/**"]
(actually the pattern doesn't matter too much as it won't be resolved anyway)

5. run pyrefly check and see the "Permission Denied" error

### Sandbox Link

_No response_

### (Only applicable for extension issues) IDE Information

_No response_