Add depends_on_external, cannot_depend_on_external to control external dependencies

[emdoyle]

Fixes: #535
Relevant to use case mentioned in: #679

This PR introduces depends_on_external and cannot_depend_on_external to module configuration. These function identically to depends_on and cannot_depend_on, but for external dependencies.

By default, no module-level checks are performed for external dependencies - instead the package-level dependencies are checked (e.g. in pyproject.toml, requirements.txt)

By adding one of these new dependency fields to a module, this will opt-in to additional controls on the external dependencies that can be used within that module.

Example:

[[modules]]
path = "tach.console"
depends_on_external = ["rich"]

The configuration above means that check-external will validate that tach.console ONLY depends on rich, and no other external packages.

Alternately:

[[modules]]
path = "tach.filesystem.**"
cannot_depend_on = ["rich"]

This configuration means that any module matching tach.filesystem.** cannot depend on rich. Other external dependencies are allowed.

NOTE: This PR does not add automatic detection of these dependencies to tach sync -- this will be done in a future PR.