Lock globs into rootdir and below

This avoids the situation where a user adds a sources=globs('../*.scala'), causing it to be silently ignored but causes issues later.

Reviewed here: https://rbcommons.com/s/twitter/r/686/
Closes: https://github.com/pantsbuild/pants/issues/348