Create policy for 3rd party dependencies

For example, ASP does:

ASP.NET's policy about third-party dependencies are:

3rd party dependencies should be strong name signed
3rd party dependencies cannot be used in code that needs to build in source-build (unless that 3rd party dep is part of source-build, like Json.NET)
3rd party dependencies must comply with all the other Microsoft OSG requirements (see https://opensource.microsoft.com/resources). This covers a range of things, like lawyer stuff, licensing and IP separation, etc., as well as component registration https://docs.opensource.microsoft.com/tools/cg.html