clsid: add tag to select suspicious CLSIDs

[decalage2]

For each CLSID, we could add a tag to show if it is suspicious (e.g. related to a CVE or a Package object). This would require to change the format of the dict to have multiple values, either a tuple or an object. In this case, need to keep a copy of KNOWN_CLSIDS with the current format, for backwards compatibility.

Alternative: add a function is_suspicious which just checks the description string for the presence of the keywords "CVE" or "package". Or add text tags inside the description string, such as "[SUSPICIOUS]".