Configurable configs-ignore

[rossabaker]

Following up on #442, I still think we want it to be configurable.

Use case: we do a lot of runtime dependency overrides when upstream lags behind our security requirements. Under this technique, the compile dependency remains the old, transitive, vulnerable version, but it is evicted at runtime. Our tooling filters compile and compile-internal. This gives us full protection of our runtime classpath (i.e., what's in prod), while maintaining a tidy set of explicit compile dependencies.

I also think compile and compile-internal would be reasonable defaults to omit.