Allows users to combine ort-config with a local config for curations, package configs and rules, etc.

[tsteenbe]

Use Case
Users of ORT for GitLab would like to use their own local configuration but also combine it with oss-review-toolkit/ort-config. For example, a user wants to keep curations and package configurations for his/her organization's proprietary packages in a private local configuration repository but for all open source package use and contribute to oss-review-toolkit/ort-config.

Currently setting up such a workflow in ORT for GitLab would require repository mirroring of oss-review-toolkit/ort-config in GitLab and adding a 'private' branch which is requires some effort and might result in Git merge conflicts. We would prefer an easier out of the box solution by expanding on the mechanism introduced in #5269.

Note: useOrtCurations introduced in #5269 only works via the CLI and can not be set via .conf file. Regardless which solution we end up implement we should make this configurable via .conf (which is how we configure ORT in ORT for GitLab)

[sschuberth]

So, aren't the only things left to do:

1. Move useOrtCurations from CLI to ort.conf (while maybe renaming it to useOrtPackageCurations).
2. Introduce useOrtPackageConfigurations to ort.conf, and also allow to consume package configurations from https://github.com/oss-review-toolkit/ort-config in combination with those from other sources?

[tsteenbe]

I wonder if we also should introduce useOrtLicenseClassifications to use license classifications from ort-config so a user only has to define their own rules.kts

[mnonnenmacher]

If this is implemented for the --ort-curations parameter it should be implemented for --clearly-defined-curations and --sw360-curations as well.

[sschuberth]

Note that by now package curations can be fully configured to come from arbitrary sources in any order.

[sschuberth]

private local configuration repository

BTW, I believe "local" to be misleading in that sentence, as it's actually a remote repository, but a private one, that should be used together with the public ort-config repository. And that's possible for curations as of #11941. A similar PR for package configurations will follow at some point.