apify push uploads .git internals below the top level of the Actor directory #1550

Problem

An ordinary apify push leaves out .git only at the top level of the Actor directory. getActorLocalFilePaths passes ACTOR_FILES_HARDCODED_IGNORE to tinyglobby, and its .git/** pattern matches only there. Git internals deeper in the directory go into the upload:

• A nested repository. An untracked clone at vendor/lib/ uploads vendor/lib/.git/config, vendor/lib/.git/index, vendor/lib/.git/objects/..., and the rest. The .gitignore rules don't catch it, because git ls-files --others lists a nested repository as a directory, not as ignored.
• A directory symlink that leads to an ancestor directory. It uploads the ancestor's .git/.
• A submodule or linked worktree. Its .git file, which holds the local path of its Git directory, is uploaded.

.git/config can hold credentials, such as the auth header that actions/checkout persists.

What we want

• apify push leaves out every .git directory and .git file, at any depth.
• Files whose names only start with .git, such as .gitignore and .github/, are still uploaded.

How it's tested

A unit test per case, each failing on the current code.