Add label and CI task to catch and document direct dependency changes

[bushrat011899]

What problem does this solve or what need does it fill?

As noted by Cart in #18263, it is currently quite easy to add new direct dependencies to Bevy, which poses a performance, reliability, and security risk to the project and its users.

What solution would you like?

• Add a new label, M-Deliberate-Dependency-Change, for PRs which intentionally add, remove, or update direct dependencies.
• Add a CI task which catches and comments on PRs which modify direct dependencies without this label.
• Update the contributing guide to indicate new dependencies must be highly trustworthy (known actor / high traffic / high visibility / high review)

What alternative(s) have you considered?

Do nothing and continue to be careful.

Additional context

Thread on Discord

[mockersf]

do we need a new label, or could the existing C-Dependencies be reused?

[bushrat011899]

do we need a new label, or could the existing C-Dependencies be reused?

Good point! I think it's reasonable to reuse that label. I can't think of a C-Dependencies PR that wouldn't also use a new M-Deliberate-Dependency-Change label, and vice versa.