Restriction lint for unsealed traits

A pattern in Rust is "sealing" traits: making them unimplementable to other users. It's typically done by doing something like:

pub trait PublicTrait: private::Sealed {
  // items
}

mod private {
   pub trait Sealed {} // empty
}

This allows one to declare that a trait is only used with internal types and should not be implemented by external users.

This has some benefits for keeping semver compatability. Codebases (like ICU4X) may wish to make this the default, just like you can already opt in to clippy::exhaustive_structs and clippy::exhaustive_enums to avoid committing to too much semver wise with public structs/enums. In a codebase with this lint enabled, every public non-sealed trait would have an allow ideally with justification.

The idea would be a lint clippy::unsealed_trait, which lints on traits which are:

• Public
• Reachable
• Do not depend (transitively) on any trait named Sealed (we could also ignore the naming) that are not reachable from other crates
• (perhaps) do not have a blanket impl for T

Transitivity might be tricky to do in a performant way.

Start by comparing the proposed lint with the existing clippy::exhaustive_structs and clippy::exhaustive_enums behavior. Work through the stated criteria for public, reachable traits and transitive dependence on an inaccessible Sealed trait, including the possible blanket-impl exception. Done means the lint design and its handling of these cases are settled and implementable.