Add lint for importing transitive dependency

[shyndman]

Hi there.

It would be great if we could get a lint to let us know when transitive dependencies are being imported. Ideally we'd like to only depend on packages that we specify in our own pubspec.

Thanks!

[krisgiesing]

Just to clarify, this is to identify the issue where we directly reference a package in code but we only depend on it transitively (in the pubspec sense). This can become an unexpected failure if the transitive dependencies change.

[devoncarew]

Sounds like a valuable lint.

The lint itself would appear in the imports for a library. It would depend in the information from that library (the imports) as well as the information from the pubspec file. I don't know if the current architecture of the linter is set up to handle that well.

Technically, this might instead be implemented as an analyzer hint. cc'ing @bwilkerson and @pq for where the best impl for this would live, and whether we should track here or in the linter repo.

[pq]

This one has been on our linter todo list for a while: #57175.

Please feel free to upvote and add any additional context there!