formula_cellar_checks: fix universal binary handling

The `check_binary_arches` audit will fail any formula that produces
universal binaries. We have a handful of formulae in Homebrew/core that
do this (see any formula that does `ENV.permit_arch_flags`, for
example). Moreover, some third party taps may have their own formulae
that build universal binaries.

I've updated the check so that it ignores a formula that produces
universal binaries whenever the formula is in the appropriate allowlist.
We'll need to create one in Homebrew/core for the handful of formulae
that do (expectedly) build universal binaries.

If we don't want to maintain an allowlist, we can easily modify this to
pass over any formulae that builds compatible universal binaries.

I've also fixed the spacing of the error this audit produces whenever
there is more than one file that fails the audit.

Library/Homebrew/formula_cellar_checks.rb

@@ -323,13 +323,34 @@ module FormulaCellarChecks
     mismatches = keg.binary_executable_or_library_files.reject do |file|
       file.arch == Hardware::CPU.arch
     end
-    return if mismatches.empty?
 
-    <<~EOS
-      Binaries built for a non-native architecture were installed into #{formula}'s prefix.
-      The offending files are:
-        #{mismatches * "\n        "}
-    EOS
+    compatible_universal_binaries = mismatches.select do |file|
+      file.arch == :universal && file.archs.include?(Hardware::CPU.arch)
+    end
+    mismatches -= compatible_universal_binaries
+
+    return if mismatches.empty? && compatible_universal_binaries.empty?
+    return if mismatches.empty? && tap_audit_exception(:universal_binary_allowlist, formula.name)
+
+    s = ""
+
+    unless mismatches.empty?
+      s += <<~EOS
+        Binaries built for an incompatible architecture were installed into #{formula}'s prefix.
+        The offending files are:
+          #{mismatches * "\n  "}
+      EOS
+    end
+
+    unless compatible_universal_binaries.empty?
+      s += <<~EOS
+        Unexpected universal binaries were found.
+        The offending files are:
+          #{compatible_universal_binaries * "\n  "}
+      EOS
+    end
+
+    s
   end
 
   def audit_installed