Improve checks for ignore containment

A proposed fix for #2327 

The diff code was using an `ignore_prefix` string to track if a parent directory was ignored that contained untracked files alongside tracked files. Unfortunately, when negative ignore rules were used for directories inside ignored parents, the wrong rules were applied to untracked files inside the negatively ignored child directories.

This commit moves the logic for ignore containment into the workdir iterator (which is a better place for it), so the ignored-ness of a directory is contained in the frame stack during traversal.  This allows a child directory to override with a negative ignore and yet still restore the ignored state of the parent when we traverse out of the child.

Along with this, there are some problems with "directory only" ignore rules on container directories.  Given `a/*` and `!a/b/c/` (where the second rule is a directory rule but the first rule is just a generic prefix rule), then the directory only constraint was having `a/b/c/d/file` match the first rule and not the second. This was fixed by having ignore directory-only rules test a rule against the prefix of a file with `FNM_LEADINGDIR` enabled.

Lastly, spot checks for ignores using `git_ignore_path_is_ignored` were tested from the top directory down to the bottom to deal with the containment problem, but this is wrong. We have to test bottom to top so that negative subdirectory rules will be checked before parent ignore rules.

This does change the behavior of some existing tests, but it seems only to bring us more in line with core Git, so I think those changes are acceptable.