UI: Don't show resultant-ACL banner in nested namespace if ancestor wildcard policy

[hashishaw]

This PR builds on the work from #26233. It hides the resultant-ACL banner if there are non-deny wildcard policies present for any ancestor of the current namespace. The changes in this PR are best illustrated through an example:

Example scenario
User Bob logs in at foo namespace and then navigates to namespace /foo/bar/baz. Bob has a policy with the following block:

path "bar/*" {
  capabilities = ["read", "update", "list"]
}

before, the wildcard calculation would determine the user does not have access because it was only checking a wildcard path at the user's relative root namespace (in this case, foo/). With this change, the wildcard calculation takes the current namespace foo/bar/baz and checks at each level if the Bob has wildcard access. The results are as follows:

• foo/bar/baz/ ❌ no match

• foo/bar/ ✅ match (exits loop)

• Ent tests pass

[github-actions]

CI Results:
All Go tests succeeded! ✅

[github-actions]

Build Results:
All builds succeeded! ✅

[hellobontempo]

Great work ✨ Thanks for the thorough comments