[BUG] Permission format regression: Cannot express fine-grained database permissions anymore

[BUG] Permission format regression: Cannot express fine-grained database permissions anymore

The new permission format that requires :* only at the end has created a significant security regression for database operations.

Previous capability (worked):

"Bash(psql * -c 'SELECT *')"  // Allow SELECT on any database
"Bash(psql * -c 'SHOW *')"     // Allow SHOW on any database

Current limitation (all fail with "The :* pattern must be at the end"):

"Bash(psql my_production_db -c 'SELECT:*')"  // Trying to allow only SELECT
"Bash(psql my_production_db -c 'SHOW:*')"    // Trying to allow only SHOW

Security impact:

Users are forced to choose between:

1. "Bash(psql my_production_db:*)" - Allows ALL operations including DROP TABLE, DELETE, etc.
2. Hardcoding every single query - Maintenance nightmare
3. Using --dangerously-skip-permissions - Defeats the purpose

Real-world use case:

Production environments need to allow read-only database queries (SELECT, SHOW, EXPLAIN, \d commands) while blocking destructive operations (DROP, DELETE, UPDATE, INSERT).

The new format makes this impossible, forcing users to grant full database access where previously they could maintain security boundaries.

Request:

Support wildcards in command arguments or provide an alternative mechanism for fine-grained database permissions.