chores: detect and label dependency change. require a review from one of maintainers

Adding new dependencies to `pyproject.toml` is a critical change where certain things must be enforced. Ideally the following should happen:

- if there's a new dependency in pyproject toml, PR gets labelled with "dependency change". we detect any dependency in any group or extra
- we use github rule or any other mechanism to enforce a review from one of core members (to be defined who)
- without this review or approval - PR cannot be merged

Start by reviewing dependency declarations in pyproject.toml, including every group and extra, then inspect the repository's available GitHub rules or other review and labeling mechanisms. Done means a pull request adding any dependency receives the "dependency change" label and cannot merge without approval from a defined core member.

Written by the indexing model from the issue text.