#3416298: Fix SSO excluded paths wildcard matching

Use the path.matcher service to match the excluded paths from the configuration. The example paths of the configuration option's description are updated, since the excluded paths need to start with / or * to match anything.

Closes #3416298