ncm-spma: check the locked packages with wildcards

This is `O(N^2)`. In a profile with lots of wildcards it'll be awful. :(

Can we look into some smarter structure to do this matching? Is there anything like tries in Perl?