Allow a whole vendor with vendor/*

allowedModels now takes vendor/* as well as model ids, like deniedModels: anthropic/* allows every Anthropic model, including new ones. Levels still intersect as sets of models, so a team's openai/* and a project's openai/gpt-5 allow just openai/gpt-5. Tick vendor/* under a vendor in the allowlist drawer.