Add allowlist/denylist of certain software packages

A (potential) customer expressed interest in being able to flag or deny images if they contain certain software packages/dependencies that aren't allowed by the organization.   

A use case would that the architectural board has a list of allowed Java dependencies or frameworks that the developers of the organizations can work with.  If a Java based image were to be pushed that uses dependencies outside of that scope then the image would be flagged as non-compliant or rejected altogether.