Add label and CI task to catch and document direct dependency changes

## What problem does this solve or what need does it fill?

As noted by Cart in #18263, it is currently quite easy to add new direct dependencies to Bevy, which poses a performance, reliability, and security risk to the project and its users.

## What solution would you like?

- Add a new label, `M-Deliberate-Dependency-Change`, for PRs which intentionally add, remove, or update direct dependencies.
- Add a CI task which catches and comments on PRs which modify direct dependencies without this label.
- Update the contributing guide to indicate new dependencies must be highly trustworthy (known actor / high traffic / high visibility / high review)

## What alternative(s) have you considered?

Do nothing and continue to be careful.

## Additional context

[Thread on Discord](https://discord.com/channels/691052431525675048/692572690833473578/1349122559089704970)