Allow the advisor to filter packages by license classification

[sschuberth]

Users might not want to disclose the names of (company-)internal packages in the lookup at (public) vulnerability providers. A way to address that would be to have configurable license classification filter for the advisor, so that only packages with licenses of the configured classifications (e.g. only Open Source licenses) are being looked up at the vulnerability provider.

[sschuberth]

(e.g. only Open Source licenses) are being looked up at the vulnerability provider.

This specific check could be implemented way simpler by just trying to look up the license in the SPDX list.

[sschuberth]

Also a more generic (Script based?) approach could be implemented that also addresses the needs of https://github.com/oss-review-toolkit/ort/issues/4892.