IMHO ad blocking is good security practice. There have and continue to be plenty of instances of malware being served up via ad networks. "Malvertising" even has its own Wikipedia page.
Wireshark doesn't use MySQL or any other SQL backend. I'm not sure what sort of dependency chain would trigger the installation of MySQL but it's unusual to say the least.
In Cloudflare's case "haven't bothered to send their own keys" implies "haven't seen the need to pay Cloudflare $200/month or $3000/month for the ability to upload a certificate+key". AFAICT only the Business and Enterprise plans allow custom certificates.
The license specified in a LICENSE or COPYING file may not match the rest of the source code. Debian's devscripts package has a utility called "licensecheck" that will scan a directory and report the license used by each file. Chromium has a wrapper called "checklicenses.py" that checks the output of licensecheck against a list of incompatible licenses. If someone were to take the next step of letting you point checklicenses.py at a remote repository the world would be a better place.