Check 3rd party repos before release or as regular CI job

[mxmehl]

At least as part of the release checklist, we should run the upcoming version of the linter against third-party repositories for which we know that they are

• rather complex (like curl)
• may use some "tricks" (dep5) (SAP repos come to mind)
• are reliable REUSE adopters and keen to keep this status
• are somewhat popular

This could be put into the checklist or as part of the regular checks in CI. There, we could pin these repos to specific commits to avoid false-negatives, but perhaps that's even not necessary as they run the linter themselves before adding commits.

[carmenbianca]

Let's do this as CI job.