Allow the returning of non-whitelisted classes when getting annotations, interfaces or superclasses (#216).
If you're searching upwards in the class graph (e.g. looking for annotations, interfaces or superclasses), you get non-whitelisted classes returned, e.g. javax.persistence.Entity (even if javax is not whitelisted, which it is not by default, because javax.* is treated as a system package) -- with the exception of java.lang.Object, since always returning that as a superclass is probably more annoying than useful.
However, if you're searching downwards in the class graph (e.g. finding classes annotated with a given annotation, or subclasses of a given class, or classes that implement an interface), then the results are restricted to classes in whitelisted packages only.
These heuristics should match people's intuitions for what the scanner should do in the vast majority of cases.