Skip files without a matching destination rule in recursive publish

[somaz94]

Fixes #1620.

sops publish --recursive stops at the first file that no destination rule matches, so every file the walk reaches after it is never published. With the layout from the issue, project/a/prod/parameters.yml aborts the run and project/b/base/credentials.enc.yml is left out.

In recursive mode such a file is now skipped with a message, the same way a file declined at the interactive prompt already is. Publishing a single file still fails as before. config exports ErrNoMatchingDestination so the publish command can tell this case apart; the error text is unchanged.

Two misconfigurations used to hit the same error, and I did not want them to turn into a run that skips every file and exits 0, so they now return their own errors: a config with no destination rules at all, and a destination path_regex that does not compile (it was treated as a non-match, while creation rules already report it).

Validation: go test ./... passes on Go 1.26.1 and the changed packages pass on Go 1.25.8. Against a Vault 1.14.0 dev server with the directory layout from the issue, main publishes one of the two files and exits 1, and this branch publishes both and exits 0.