How to maintain semver when consuming dependencies?

We try to follow semantic versioning (https://github.com/aws/sagemaker-distribution?tab=readme-ov-file#versioning-strategy, https://semver.org/). However, there are some problems with this in the way we consume dependencies.

1. Any package we consume can just not follow semver, and there would be no way to detect it. This could introduce backward-incompatible changes. We do call this out in our Readme _"it is important to note that Amazon SageMaker Distribution’s ability to follow semver guidelines is currently dependent on how its dependencies adhere to them"_
2. We consume several (15 as of 1.5.2-cpu) packages with major version 0 e.g. `0.y.z`. According to semver docs, these versions **do not** adhere to any semver specifications, and should not be considered stable (see https://semver.org/#spec-item-4). Currently these are being treated the same as any other major version.

It would be nice to have some strategy/tooling to at least try to enforce semver principles for our releases, so opening this issue to host discussion on this topic.

Start with the README's Versioning Strategy and the linked Semantic Versioning specification, then inventory the 0.y.z dependencies mentioned in the issue. The issue does not define a chosen strategy, implementation entry point, tests, or acceptance criteria; an agreed approach and release-validation definition would be needed before coding can begin.

Written by the indexing model from the issue text.