RFC: support recursive path pattern delegations

At the moment, the wildcards supported by PATHPATTERN only allow you to match within one directory, but this is quite problematic if you want to delegate entire directory trees to a role. A fairly simple example where this would be particularly useful is if you use directories to represent projects which can then delegate to sub-projects -- the top-level delegator role would not know how the delegatee's structure looks in order to create a comprehensive PATHPATTERN, but all they would care about is the top-level directory.

The simplest proposal that matches the existing Unix glob-like semantics would be to allow for ** to act as a wildcard that matches / as well (many Unix tools support that as a special kind of glob). An alternative approach would be to allow for a PATHPATTERN to define a path prefix to match against, but ** is more generic.

Regardless of the approach taken, clients would likely need to gate this new matching behaviour based on the spec_version in root.json as otherwise they may start to misinterpret older repository data that inadvertently used ** instead of * for regular globbing.

Start by reviewing the existing PATHPATTERN semantics and how spec_version is represented in root.json. Compare the proposed ** recursive matching with the path-prefix alternative, then define the version-gating behavior; done means the specification has one decided approach and clearly describes its compatibility rules.