Add validation to test that OOB packages have no SharedFx-only references

We had a situation in 8.0 where `Microsoft.Extensions.Caching.StackExchangeRedis` (which is an OOB package) added a dependency on `Microsoft.AspNetCore.OutputCaching` (which is SharedFx-only), which caused `StackExchangeRedis` to have a FrameworkReference on AspNetCore.App. This means devs using `StackExchangeRedis` would need to have Asp.Net installed on their machine in order to use the package, which goes against the principle of an OOB package (they should be useable by non-asp.net devs). We should add validation, maybe in `ResolveReferences.targets`, that prevents this from happening again, as it's a very easy mistake to make.