Automate API rules

[DavyLandman]

We have some APIs that we know should not be touched, (see developer.md) unless they're via one of our wrappers/translators that make it safe. For example ISourceLocation::toUri, or the supplyAsync without a exexutor.

Let's either:

• see if we can extend checkstyle (that we already use)
• write small rascal program that use java-air to check api patterns
• see if we can use custom rules for error-prone to lock these down.