This PR introduces a few related changes:

* use_category is restructured to distinguish core/extension deps. There's also an extension
  allowlist added for each dependency in the dataplane_ext and observability_ext category.

* tools/dependency/validate.py is introduced to validate a bunch of structural relationships
  implied by the bazel/repository_locations.bzl metadata. This includes that test-only deps
  aren't used in //source/.., that some obvious dataplane/controlplane packages taint the
  appropriate reachable deps and that the association between extensions/deps holds.

* The CI docs jobs now runs tools/dependency/validate.py.

* The dependency dashboard at
  https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/external_deps
  to include granular information on which dataplane/observability deps come from core/extensions.

* Some misc. cleanup of source code dep that came up while working on this.

Risk level: Low
Testing: Pyunit tests added for validate.py.

Part of envoyproxy#12673.

Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Harvey Tuch <htuch@google.com>

Signed-off-by: Harvey Tuch <htuch@google.com>