Enforce import from `__all__` (at least locally)

I understand that ruff can't check imports are valid in a general way, but it would be great if ruff could check local (relative) imports only import things listed in `__all__` where `__all__` is defined.

## Example of what I want

**foo.py**:

```py
__all__ = ('public_thing',)

def public_thing():
pass

def private_thing():
pass
```

**bar.py**:

```py
from .foo import public_thing # 👍

from .foo import private_thing # 👎 FXXX 'private_thing' not declared in __all__
```

---

This would only apply where `__all__` is defined in the module scope obviously.

Any chance ruff could be extended to support this?

This get's fairly important in big packages. But I don't currently know of a tool which enforces `__all__` and I'm resisting the the impulse to build one myself.

No files, tests, or entry points are named in the issue. Begin by locating Ruff’s existing import-related checks and handling of module-scope __all__; done means relative imports of names absent from a defined __all__ produce the requested diagnostic while allowed imports remain valid, with coverage for the examples.

Written by the indexing model from the issue text.