ignore: honor nested negation across rule sources - #7339

Summary

Fix ignore negation when the excluding and re-including rules come from different sources.

A nested .gitignore can now re-include a directory excluded by a parent .gitignore, matching core Git. Higher-precedence internal and per-directory rules can also override lower-precedence info/exclude or global excludes. Descendants of an ignored parent remain ignored unless the parent itself is re-included.

The parser now retains negation rules regardless of whether the matching positive rule is in the same source. Path lookup continues to parent components after a negative match, while the workdir iterator preserves the ignored state inherited from an ignored parent.

Closes #7284.

Tests

• Debug targeted ignore::path and ignore::status: 84/84 passed.
• Git CLI compatibility matrix: 252 scenarios, 378 paths, 0 mismatches.
• Release non-network CTest: 7/7 passed.
• ASan full offline and util CTest: 2/2 passed.
• ASan+UBSan targeted ignore tests: 84/84 passed.
• Werror compilation for the two touched source objects: 2/2 passed.

A local 10,000-file iterator benchmark, after warmup, measured approximately 0.107 s at ignore depth 1 and 0.235 s at depth 80. The previous implementation measured approximately 0.952 s at depth 80.

The online suite was attempted but did not complete because network operations timed out.

Two broader baseline failures are unrelated to this change:

• The combined-sanitizer full run reports a misaligned uint32_t access in the unchanged bundled sha1dc/sha1.c.
• The full Werror build reports a maybe-uninitialized warning in the unchanged deps/reftable/stack.c.