[New Feature]: Package Deny List

Description of the new feature/enhancement

Some publishers have requested their applications be removed from WinGet, which is completely understandable; other packages may be blacklisted due to PUA; and yet others still may be blacklisted for any number of reasons. However, there is no way for the community to know which packages those are, with the list of "blocked" packages being entirely tribal knowledge currently. This information should be recorded somewhere and automated against if possible.

Note that there are two types of "blocked" - Technically blocked by an issue (Interactive-Only, Dependencies, Hardware), and the ones blocked by Policy (not the review policies, but general policy). This request is specific to those that are blocked by policy such as FileZilla or EstMob SendAnywhere

Proposed technical implementation details (optional)

1. [Implemented] A markdown file or some other doc with a table of the package, description of why it was blacklisted, and a link to the request, if possible.
2. [Implemented] Automatic addition of labels; I believe only Estmob SendAnywhere currently has an automatic label applied to the PR's,
   • Labels should be applied to PR's containing certain words in the title to flag moderator attention when reviewing
   • Labels should be applied to issues containing certain words to flag attention when triaging, and to pre-notify users of the blacklist
3. Smarter validation pipelines, since the URL Domain Validation task isn't perfect. . .
   • There should be the ability for MSFT engineers to add a blacklisted domain
   • When a manifest contains the blacklisted domain in a URL, validation should trigger a warning
   • Validation-Domain label should be applied, or a more specific label if appropriate
   • The reason the Validation-Domain is triggered should be recorded in the Pipeline artifacts
     • Specifically the ValidationResult/DomainUrlValidation.json => TestPlansResults.FieldsMetadata.[index].Message
     • Example: "Domain blocked by publisher request"
     • Example: "Domain known to serve PUA"

Start by locating the proposed markdown blacklist and the URL Domain Validation task. Review how validation artifacts expose ValidationResult/DomainUrlValidation.json and TestPlansResults.FieldsMetadata.[index].Message, plus the label automation for issues and pull requests. Done should cover the package list, policy-related labels, and domain validation warnings with recorded reasons.