[5.5] add fullUrl wildcards to except array in VerifyCsrfToken

[BenCavens]

This is an improvement on the following PR that is already merged into 5.5.
#22619

The former PR made sure full URLs could be passed in the except array of the VerifyCsrfToken middleware. This PR adds wildcard support for full URLs as well. It is fully compatible with existing behaviour: both paths and full URLs can be added, with or without the * wildcard. e.g.

protected $except = [
    '/foo/bar',
    '/foo/*',
    'http://example.com/foo/bar', // Now possible to add full url with except matching
    'http://example.com/foo/*',   // or with wildcard
];

This PR contains tests on both the matching logic as well as for the request::fullUrlIs() method, which is used in the VerifyCsrfToken middleware.

[vlakoff]

I didn't notice there was a fullUrlIs() method, and you are even adding tests for it, that's fantastic.