Allow whitelisting of top-level packages and their transitive dependents

[brettz9]

Hi,

It appears that packages only checks for the license of that particular package and not its children.

I am interested in being able to check for particular packages and all of their children.

My use case is that in some repositories, particularly browser-based ones, I add scripts to copy items out of devDependencies into the repository so that they can be hosted by Github hosting like Github Pages (while still being able to take advantage of npm versioning).

For such repos, I'd like to be able to detect the licenses without checking all devDependencies--only those I know that we are bundling.

Do you expect this would be an easy addition?