PoC schedule-based malware check

[woodruffw]

Like #7198, we'll need a schedule-based malware check for proofing.

The current proposal: a scheduled check for complete turnovers (i.e., no original or previous maintainers/role-holders remaining) in package ownership, graded against other suspicious indicators (IPs not previously seen for the package and/or its maintainers, new maintainers(s) are not in the community of any the the previous maintainers beyond a fixed window).

See #7096.

[xmunoz]

This might be too complicated for v1, but I think the idea behind sourcerank is really interesting:
https://libraries.io/pypi/requests

A high score combined with complete turnovers might be an interesting signal.

[woodruffw]

Merged; will close when this hits master.