Track 3rd party libs used in the dist package

### Description

It would be great to at least somehow track the 3rd party deps in a way that they need changes to the PR itself if new ones gets added - which will drag attention toward them and could possibly improve the situation.

### Motivation

It seems like there are quite a few versions of the same lib in the distribution build - these might have landed via transitive deps and most likely without being considered.

The issue names no files, tests, or build entry points. Start by locating how the distribution package and its transitive dependencies are assembled, then determine how third-party libraries are currently declared. Done should mean the distribution dependencies are explicitly tracked and adding one requires a visible PR change.

Written by the indexing model from the issue text.