Package allowlist

[jadoonf]

We should have a way to ignore user specified packages in lstn scans.

Thinking out loud in terms of design:

• Specify in a config file - a few ideas:
  • add the packages to be excluded in the lstn.yml config file
  • create a new config file e.g. lstn_allowlist.yml which the CLI/action can read from
  • add to lstn_rules.yml
• Handle in lstn CLI flag
  • e.g. lstn scan . -e <package to be excluded>

Further additions on this could be allow the user to ignore specific classes of problems or behaviours. For example:

• ignore specific binaries (eg. i don't want any binary builds because i'm shipping to web browsers)
• ignore specific maintainers (e.g. ignore alerts for X maintainer or org that I trust)