Avoid production source glob checks in no-op builds

[floze-the-genius]

Summary

• replace the production CONFIGURE_DEPENDS source globs with an explicit source list
• add a CTest check that compares the explicit list with the C++ files under src/
• keep test source discovery unchanged

This prevents consumers that use add_subdirectory from running CMake's glob verification on every no-op build, while the regression test catches newly added production sources that are missing from the explicit list.

Fixes #1463.

Validation

• Ubuntu 24.04, GCC 13, CMake, and Ninja: configured with YAML_CPP_BUILD_TESTS=ON, built all targets, and passed both CTest tests
• configured with tests and tools disabled: the second Ninja build reported ninja: no work to do. and generated no VerifyGlobs.cmake
• external add_subdirectory consumer with YAML_CPP_BUILD_CONTRIB=OFF: built successfully and had a clean second no-op build
• negative regression check: an unlisted temporary src/forgotten.cpp caused yaml-cpp::source-list to fail as intended

AI assistance disclosure

OpenAI Codex was used as a coding tool to inspect the repository, implement this change, and run validation. The patch was checked with the validation listed above.