Future Feature Request: Package License Validation

## Proposal
Users running their own Entropic instance should be able to add specific project licenses to an approve/deny list for both published and mirrored packages.

### Published Package Restrictions:
Allowing registry instance runners to restrict the licenses of published packages on their servers will enable organizations, that may choose to provide a registry-as-a-service to members, to enforce a common set of approved licenses for all published packages under their purview.

### Dependency Mirror Restrictions:
Enabling registry instance runners to restrict licenses of mirrored dependencies of published packages (presumably validated on publish) will help with corporate adoption where legal departments will want to prevent accidental use of code that is not allowed for private use. Warnings could presumably also be thrown at install time to help inform developers early that their package will not publish to its intended host registry because of an offending dependency.

## Outstanding Questions

- Is this feature out of scope for the Entropic registry?
- Do we want to allow registries to differentiate between published packages intended for production, and published packages intended for build/dev time only? I think I remember that there are licenses that can not touch production, but are fine to run as a dependency of internal build tooling (may be wrong here, happy to be corrected).
- ???