go/private: optimize _filter_options to avoid O(n²) scan (#4590)

Split the denylist into exact-match entries (dict lookup, O(1)) and
prefix-match patterns (those ending in "=", e.g. "-fmax-errors=").

Only the rare prefix patterns require a linear scan, eliminating the
previous O(options × denylist) _match_option loop for the common case.

This provides a significant reduction in CPU time on large repos:
| | Before | After |
|--|--|--|
| `_filter_options` CPU | 123s | 0.004s |
| `_match_option` CPU | 56s | **0s** |

Co-authored-by: Fabian Meumertzheim <fabian@meumertzhe.im>