Add a check inspecting both source and binary `rpm`s for unacceptable files e. g. for licensing reasons

[mkoncek]

As an example, see log4j package between versions 2.17 and 2.17.2 and the file glyphicons.zip.

[mizdebsk]

ScanCode toolkit can be used for this.