fix: sources brace expansion

[pd93]

Fixes #2073

Removes zglob as a dependency and instead relies on mvdan's expand.Fields with globbing turned on for sources globs.

We also use expand.Fields in multiple other places to resolve things like ~ and environment variables. However, most of the time, we don't also want brace expansion or globbing, so I have separated this into two functions. One wraps expand.Literal which returns a single string with just the variables resolved, and the other wraps expand.Fields with braces and globbing enabled.