improve .vmcignore; use before checking symlinks

now behaves more closely to .gitignores:
- /foo will only match at toplevel
- foo/ will only match a directory (at any depth)
- foo will match anything at any depth
- foo/bar will match a pathspec from toplevel

[finishes #45562281]
clean up Rakefile