Make patch-package patches invalidate asset caches and run specs

What does this MR do and why?

Follow-up to gitlab-org/quality/analytics/ci-health-incidents#1328 (root cause note): the Vue 2 patch from !257887 (merged) reached master green and broke three system spec files about 50 minutes later.

patches/ was invisible to CI:

Where	Before	After
scripts/lib/assets_sha.rb (assets cache key)	not an input	patches/**/*.patch included
config/helpers/vendor_dll_hash.js (webpack vendor DLL name)	package.json, yarn.lock, webpack configs	plus every patches/*.patch, sorted
config/rspack.config.mjs persistent cache version	browsers hash, Vue version	plus the same dependency hash
babel-loader and vue-loader cacheIdentifier (webpack and rspack, persisted in the CI tmp/cache cache)	Babel/Vue/webpack versions	plus the same dependency hash, since the tmp/cache cache key can only name two files and a patched vue-loader would otherwise be masked by a stale loader cache
.gitlab/ci/rules.gitlab-ci.yml	no anchor matched patches/	added to every *-patterns anchor that lists {package.json,yarn.lock} (12 anchors) and to .gdk-component-patterns; new .frontend-patch-patterns anchor referenced in the same four system spec rules as .workhorse-patterns

Consequences for a patches-only MR:

• compile-test-assets misses the cache and compiles the patched node_modules, so the DLL actually contains the change under test.
• The full system spec suite runs, the same way a workhorse/ change does, since the predictive mapping cannot attribute a runtime patch to specific specs. Unit and integration specs stay predictive, as for yarn.lock.
• Jest, frontend fixtures and bundle-size review run through the frontend dependency and build anchors.
• On master the cache key changes with the patch commit itself, so later pipelines can no longer pick up a stale build under the parent's key.

Not changed on purpose: Vite. CI builds no assets with Vite, and Vite 8's dependency optimizer already includes a patches/ directory in its dependency hash.

Verification

• bundle exec rspec spec/scripts/lib/assets_sha_spec.rb: new example asserts patch files are in the SHA input.
• node -e "require('./config/helpers/vendor_dll_hash')()" and an ESM import from rspack.config.mjs both resolve.
• NODE_ENV=production node -e "require('./config/webpack.config.js')" and require('./config/rspack/vue.js') load.
• rubocop, eslint, prettier clean; rules.gitlab-ci.yml loads with YAML aliases.

MR acceptance checklist

• I have evaluated the MR acceptance checklist for this MR.