Add forbidden-uses audit

[Holzhaus]

Fixes #558.

Not finished yet, but if you have any comments on the configuration part, let me know.

[woodruffw]

Thanks @Holzhaus! This looks great as a start; I left some initial comments.

[woodruffw]

Just flagging as a note for myself: when documenting this new audit, we'll need to make sure users understand what it can and can't do. In particular, if a user is concerned about impostor commits, then this audit doesn't protect against those directly since foo/bar@hash... can be a hash... from a different org/repo in foo/bar's network.

This is OK IMO, since we have the impostor-commit audit for exactly this purpose. But it should be clear in the docs to users that they need to run both, if impostor commits are inside their threat model.

[woodruffw]

I thought about this some more, and I think I want to merge this with the existing unpinned-uses audit -- the two overlap closely, and would conflict in some ways if left unmerged.