glob patterns in denyRead cause startup delay when walking large directories

[ghost91-]

Steps to Reproduce

1. Install fence to /usr/bin/
2. Create ~/.config/fence/fence.json:

   {
     "filesystem": {
       "defaultDenyRead": true,
       "allowRead": ["."],
       "denyRead": ["**/.env"]
     }
   }

3. Run from a large project directory:

   fence -- ls

Expected Behavior

Command runs quickly with .env files blocked.

Actual Behavior

Command hangs during glob expansion. The ** patterns cause fence to walk the entire directory tree at sandbox startup.

Cause

Fence expands ** glob patterns at startup via ExpandGlobPatterns(), walking all matching files before the sandbox starts. For large projects or patterns like **/.env, this causes significant delays.

Suggestion

Consider evaluating glob patterns at runtime rather than pre-expanding them. This would:

1. Avoid startup delays
2. Handle patterns that match many files
3. Match files created after sandbox start

Workaround

Use non-recursive patterns like .env or *.env for root directory only, or use defaultDenyRead: true with explicit allowRead paths.