`no-restricted-paths` should support negated glob pattern

### Bug Description
We cannot use a negated glob pattern (e.g. `'!dir_to_exclude/**'`) in `zone.target`, `zone.from`, and `zone.except`.

### Impact
This prevents us from specifying a target that matches anything except certain files or directories. Fixing the bug should help address the use case requested in #2497 as well.

### Root Cause
This is due to `path.resolve` is used to resolve the glob patterns like a relative path (e.g. `'!dir_to_exclude/**'` becomes `'/home/project_dir/!dir_to_exclude/**'`), making it invalid.

### Suggested Fix
I'd love to suggest the following fix:
1. When constructing a minimatch matcher, instead of resolving the glob patterns as paths, the glob patterns shall be passed as is to minimatch, and
2. When matching a path, instead of using the absolute path, the path should be resolved as a relative path to the base path specified in `base`.

Start at the implementation and tests for the no-restricted-paths rule, focusing on minimatch construction and the path.resolve calls described in the issue. Verify that negated patterns work in zone.target, zone.from, and zone.except, and that matching uses paths relative to base; add or update coverage for those cases.

Written by the indexing model from the issue text.