Support subgroup

[bapt]

By matching the group name with globs, it allows users to define valid groups the following way:
groups: [ "groups/*" ]
to allow subgroup to work

[jech]

I agree with the need for this feature. Related feature: https://lists.galene.org/galene/87ikrvfzdm.wl-jch@irif.fr

I have two minor objections to your patch:

• a group could be called *, so the syntax is ambiguous;
• you're now walking the whole groups table, so the behaviour is O(n).

[bapt]

new attempt, trying to address your comments

[jech]

I think it needs more thought.

Right now, it's an all-or-nothing option, it's not possible to set some groups to allow subgroups and not others. I'm sure it solves your immediate need, but I think we need a more general solution.

I'm a little worried about the lastIndex bit. What if the client passes a string like /groups/foo/bar, will you grant them access to /groups/foo/baz?

You still have O(n) behaviour in the allowSubgroups case. You need to do something like (I didn't check the details):

    for group != "" {
        if groups[group] {
            return true
        }
        group = path.Base(group)
    }