quoted

+check_forbidden_additions() { # <file>

This function looks to work with stdin, not a file.
Better to remove the comment about a <file>.

It can actually work with both  but you are right. The comment is not
beneficial there
Will fix with the rest of the list below
...

quoted

+     if [ $? -ne 0 ] ; then
+             ret=1
+     fi
+     printf '%s\n' "$report"

You are printing the report, no matter of the result? Why?
Is it because a warning does not return as an error?

There is maybe an improvement required here.

Yes this is indeed the reason.
Sticking to a simple success/fail in the return value with the price of
printing an empty string in the case of no-warning seemed better than
handling multiple (>2) return codes .
Do you have a preferred way here?