The URL pattern matching system used for web fetch permissions has been rewritten with more robust handling. It now uses a placeholder-based approach for wildcards, properly handles protocols, ports, and paths, and falls back to regex matching when the pattern isn't a valid URL.
Evidence
New WY$ function with comprehensive URL matching (search for "zzwildcard")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.