Enforce import whitelist during loading

This is so that CI will continue to enforce the restricted imports needed for portmod <2.4 once !422 (merged) is merged, since that allows arbitrary imports, and it isn't something we can enable only when Pybuild2 is used, since it's a global feature. We won't be able to easily ensure that packages continue to work with older versions of portmod once 2.4 is out and CI switches to using that, but we can at least make sure no-one using a development version of portmod accidentally submits packages which don't work on the current version.