[Feature Request] Allow configuration of `package_todo.yml` violation destinations

Proposal

Allowing configuration for whether a violation gets reported in either the offending package's package_todo.yml or that of the offended package will allow users better control over how they track and assign ownership of packwerk violations.

Motivation

We are working to incrementally adopt packwerk in the GitHub monolith. Particularly with the privacy checker, we have had multiple teams request that violations against private constants be tracked in the todo file for the package that owns the constant, rather than distributed across each offending package.

Adding new privacy violations to the offended package's todo file allows the codeowners feature to automatically tag the impacted team to review the PR.

Adopting packwerk is very much an incremental process for our application, with the journey to strict enforcement levels containing multiple stages. Being able to configure violation destinations helps us to match packwerk reporting more closely to our organizational expectations for how violations are owned and worked through.

Context

A version of this feature had a prior PR. Some time has passed since that initial discussion, so I would be curious to hear your updated opinions.

The PR solves our request essentially as-is. I could also see an argument for making the destination more user configurable if there is concern about the broader community agreeing with our destination preferences.

Start by reviewing prior PR #261 and the package_todo.yml reporting behavior described in the issue, especially the privacy checker path. Determine how a configurable destination should select the offending or offended package, then verify that violations are written to the configured package's todo file and that ownership tracking remains correct.