Fix AndroidQF artifact discovery in root-level ZIP archives

[besendorf]

AndroidQF modules look for artifacts using patterns such as */packages.json. Directory input includes the acquisition directory in each path, but a ZIP can contain packages.json at its root. Those ZIP members were not matched, so modules returned no records even though the equivalent extracted directory worked.

Allow the leading */ to match an absent directory prefix, and normalize separators only for matching. Preserve original filenames and their order so archive reads still work and overlapping patterns do not duplicate results.

Fixes #931.

Validation:

• Added 39 regression cases covering all eight artifact patterns, root-level and prefixed ZIP layouts, Windows paths, ordering, and command-level property extraction, indicator alerts, and timezone lookup. All pass; 10 failed against the original matcher on Windows.
• Ruff check, formatting checks for changed files, and mypy --platform linux pass.
• Full suite on Windows/Python 3.13: 490 passed, 4 skipped, 14 failed. All 14 failures were reproduced on unchanged 178ac52; they concern existing platform/environment behavior. The AndroidQF subset has 72 passing tests and one existing CRLF assertion failure.
• Native Windows mypy reports the existing os.O_NOCTTY error in common/password.py; Linux-targeted checking passes.