Add a "configuration policy" concept to (dis-)allow configuring of things inside .ort.yml

[sschuberth]

Triggered by the discussion around request #9017, and also as a way to generalize the "loose"

enableRepositoryPackageConfigurations: true
enableRepositoryPackageCurations: true

properties that we already have, we could come up with a generic mechanism that (dis-)allows to configure arbitrary settings as part of the repository configuration in .ort.yml.

An idea is to have config.yml entries like

repositoryConfigurationPolicy:
    allowedConfigurationPaths:
    - "$.excludes.paths"
    deniedConfigurationPaths:
    - "$.excludes.scopes"

The above would create a policy that allows path excludes to be configured in .ort.yml, but disallow scope excludes to be configured. The syntax of the entries are JSON paths, which also allow for wildcards, to even match yet unknown / future properties, or set defaults for root levels in the hierarchy.