Backport of 'Anchor and escape EnvironmentMatcher wildcard patterns'

Related:

• Merge to master: e20d16ce
• Original backport (master): https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/6581
• Original backport (19.1): https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/6593
• Original backport (19.2): https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/6592
• Original backport (19.3): https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/6622

What does this MR do and why?

Backports e20d16ce ("Anchor and escape EnvironmentMatcher wildcard patterns") from the default branch to 18-11-stable-ee.

The fix covers CVE-2026-13210, incorrect authorization in the CI/CD environment variable scope matcher, CE/EE, severity::2. Gitlab::Ci::EnvironmentMatcher#wildcard_regex built an unanchored, unescaped regex, so an environment_scope of review/* matched any environment name containing review/ anywhere (e.g. not-review/app1), leaking environment-scoped CI/CD variables and GitLab agent Kubernetes CI-access authorization into the wrong environments. The fix anchors the pattern with \A/\z and escapes literal segments with Regexp.quote, via Gitlab::UntrustedRegexp.

Three files change from the cherry-pick: lib/gitlab/ci/environment_matcher.rb and two spec files. A second, small follow-up commit adjusts one ported spec row (['*', '', true] -> false) to match this branch's actual Gitlab::UntrustedRegexp#match? behavior, which still gates on a non-blank string here; nothing else was changed.

18.11 is outside the usual three-version backport window, but self-managed customers on it are still exposed. This was raised with release management in https://gitlab.com/gitlab-com/gl-infra/delivery/-/work_items/22388 and is planned for the 2026-09-23 patch. The fix is already public, released in 19.1.8, 19.2.6, and 19.3.2, so the backport is opened here rather than on the security mirror, which rejects stable branches outside the maintenance policy.

https://gitlab.com/gitlab-org/security/gitlab/-/work_items/1752

MR acceptance checklist

• This MR is backporting a bug fix, previously merged in the default branch.
• The MR that fixed the bug on the default branch has been deployed to GitLab.com.
• The MR title is descriptive.
• Required labels have been applied to this merge request
  • severity and bug subtype labels
  • customer label, if applicable (no exact "customer" label exists in this project; open question, not applied)
• This MR has been approved by a maintainer (only one approval is required).
• Ensure the e2e:test-on-omnibus-ee job has succeeded (not yet triggered as of this update).