The idea is to append the path_excludes column to the path_includes column under a new column just named paths in the sub_repo_permissions table. All path_excludes entries should be prepended with a - to indicate that it is an exclusion.

This way, simply iterating over the paths should yield the same behaviour as our current implementation, with excludes taking preference over includes.

This allows for a smooth transition into the simplified rules matching where the paths column just has to be updated.

/cc @sourcegraph/iam