out-of-tree checks

These changes allow us to easily host brakeman checks outside the source tree. We have custom checks that aren't generally meaningful and would be cumbersome to others if they were in the source tree.