--check_direct_dependencies should default to "error"

### Description of the feature request:

Change the default value of --check_direct_dependencies from "warning" to "error":

>[`--check_direct_dependencies`](https://bazel.build/reference/command-line-reference#flag--check_direct_dependencies) = `` default: "warning"
> Check if the direct `bazel_dep` dependencies declared in the root module are the same versions you get in the resolved dependency graph. Valid values are `off` to disable the check, `warning` to print a warning when mismatch detected or `error` to escalate it to a resolution failure.

### Which category does this issue belong to?

Core

### What underlying problem are you trying to solve with this feature?

This feature already exists and has the potential to protect users from unexpected package upgrades and the unintended side effects that they can bring along.

Here's the exact situation that I encountered last week:
- my project uses `rules_python` 0.26.0
- I pulled in a new dependency, `rules_multirun`, which happens to use `rules_python` 0.27.1
- this had the unintended side effect of upgrading my project to `rules_python` 0.27.1, which broke some of our internal tooling and was unfortunately not caught prior to deployment

This was arguably my fault: a warning _was_ emitted, but I didn't happen to notice it in time. Even once I did see it, it was not clear what what had introduced the issue—the message doesn't explain _why_ the resolved dependency graph didn't match the root module:

````
WARNING: For repository 'rules_python', the root module requires module version rules_python@0.26.0, but got rules_python@0.27.1 in the resolved dependency graph.
````

The good news is that `--check_direct_dependencies=error` already exists and solves this problem completely; when set, we get an error instead:

````
ERROR: For repository 'rules_python', the root module requires module version rules_python@0.26.0, but got rules_python@0.27.1 in the resolved dependency graph.
````

If this had been an error, the source of the discrepancy would've been immediately obvious. Unless there are other implications to this change, I believe that changing the default value to `error` makes a lot of sense and would make Bazel safer and easier to operate, particularly in larger repositories with many dependencies and many contributors, not all of whom are necessarily Bazel experts.

### Which operating system are you running Bazel on?

macOS, Ubuntu

### What is the output of `bazel info release`?

release 6.4.0

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

_No response_

### Have you found anything relevant by searching the web?

Slack conversation:
https://bazelbuild.slack.com/archives/CA31HN1T3/p1711391497929079

### Any other information, logs, or outputs that you want to share?

_No response_

Read the --check_direct_dependencies command-line reference and locate the flag's implementation and existing coverage. Confirm the current warning default, then verify that the error setting causes resolution failure and that the documented default and relevant tests reflect the requested behavior.

Written by the indexing model from the issue text.