install-deps: a way to set expectations?

Right now we compute install-deps and forward them along, but we don't have any way to check them against an expectation. The classic reason to want this is to want to completely deny dynamically-linked OpenSSL, but you could imagine plenty of other checks and stuff.

The main issue is that the linkage checker is necessarily very late in the process, only after you've built your app. So these checks could be used for `pr-run-mode = upload`, but not `pr-run-mode = plan`. In contrast, tools like `cargo-deny` just look at your build tree (and feature flags) to make that call, so they can be run eagerly and often.

Start by tracing how install-deps are computed and forwarded, then locate the late linkage checker used after the app is built. Define how expectations should be configured and enforced for pr-run-mode = upload, while accounting for the stated limitation that pr-run-mode = plan cannot perform these checks.

Written by the indexing model from the issue text.