Specific branch protection doesn't (always) override wildcard protection

[eNBeWe]

Description

We have configured branch protections for lots of branches (think: all release branches).
Usually pushing on these branches should be forbidden, but during the release cycle the new release should be open to backport fixes and stuff.
So we create a wildcard protection "release/**" that denies all pushes and a specific protection "release/v1.0.0" that allows pushes from specific users.
The resulting behaviour is not always the same.

Sometimes it looks like this:

In this case, the global protection is always in place and no pushing is possible on any branch.

Sometimes the two rows of glob and specific are switched (specific first, glob second).
Then the specific protection works and the allowed user can push that branch.

To me it looks like some kind of issue with ordering the protections. But I didn't find a way to "force" some ordering by e. g. creating the protections in a specific order or by a naming scheme.

Test Repo at try.gitea.io: https://try.gitea.io/eNBeWe/TestFooBar

Gitea Version

1.19.0+28-g81a995cd8

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

2.25.1

Operating System

Ubuntu Linux 20.04.6

How are you running Gitea?

Binary installation according to docs, using systemd.

Database

PostgreSQL