allowed_images: Allow subdirs in image paths
Adds /**/
to wildcards for:
docker-registry.wikimedia.org/**/*
registry.gitlab.com/gitlab-org/**/*
According to doublestar documentation, this matches zero or more directories.
See also: https://gerrit.wikimedia.org/r/c/operations/puppet/+/805247/
Bug: T310535