Allow whitelisting dependencies in the list command

I'm currently using the list command like so

sbom-utility \
    license list \
    --config-license /my-custom-policy-v0.1.0.json \
    -i /my-sbom.json \
    -o /license-error-summary.json \
    --where "usage-policy=needs-review|deny|UNDEFINED"

My use case for this is filtering out all the items in my SBOM that are not "approved" license categories. This tool very conveniently returns a non zero status code when anything makes it though the filter, and gets displayed as a nice summary table. This is great, because it allows for easy human review, and should slot into a CI pipeline easily.

I'd like to do just that, and put this in my CI pipeline, so that I can prevent packages with unapproved licenses from making it into my repo. The only issue is that there's no way to whitelist packages that make it though the filter. This would be useful when you're using a package with a paid license and you want to allow that package at a particular version though ("allow My.Package.Name v1.2.*"), but you don't want to approve all packages with whatever that license type is.

Currently the solution to that is to parse the summary text table and try to filter that, which is a bit brittle. My hope was that the issue https://github.com/CycloneDX/sbom-utility/issues/76 resolves that by making the output JSON easier to parse in a program, and I can do my own whitelist and then draw a different summary table for the CI.

What would be ideal is some way to specify a file/filter that contains some whitelist of packages/versions that are allowed, similar to the config-license input. This way, I wouldn't need my own tool, I could make the license checking happen all using CycloneDx tooling. Not sure what the best way to achieve this is though, probably needs a bit more thought. I tried to have a punt at using more regex in the where clause, but I found it didn't work as the regex module in go doesn't allow the reverse lookahead, so I can't specify "everything that needs review and is undefined BUT isn't package blah).

Not sure if there's an easier way to do this either!