Add no-outside-dependency guideline

Signed-off-by: Steven Barth <steven@midlink.org>