bakery: add support for need-declared third party caveat

This makes it possible to add a third-party caveat that requires
some declared caveats and be assured that (as long as they're
using the bakery package) they will be added.