deps extractor: Support limiting ecosystems

[puerco]

Minder's dependency extractor scans an entire ecosystem and reports back dependencies found anywhere in the codebase, and even from manifests such as SBOMs.

This can make it tough when a repository contains more than one source of dependencies such as more projects, SBOMs, test fixtures, etc. One way of scoping the data available to rules is to create a setting in the dependency extractor to pass a list of desired ecosystems, scanning can be fine-tuned to return only relevant results and the process can run more efficiently.

The list of ecosystems should be a list of strings and we should validate each to be a valid package URL type.

Related to #5128