The goal is to make it easy to compile version locks for all runtime
dependencies in a way that is robust to human error. By using the
wildcard extra the risk of forgetting to list any extra is removed.

Since the expanded extras are needed when we look for the wildcard it
is moved to before the loop. This is OK because it does not depend on
the loop and nothing in the loop depends on its previous value.

... to not give users the misleading impression that pattern matching,
with regex,  fnmatch or some other system, works.

Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>