[CT-2494] Detect and restrict project-level cycles in dependencies.yml

[MichelleArk]

Example:

Project A

(no dependencies.yml)

-- project_a_publication.json

{
	"project_name": "A"
	"dependencies": []
}

Project B
Has access to project A’s publication artifact

-- dependencies.yml

projects:
- project: A

-- project_b_publication.json

{
	"project_name": "B"
	"dependencies": ["A"]
}

Project C

Has access to project B’s publication artifact, but not project A’s
-- dependencies.yml

projects:
- project: B

-- project_c_publication.json

{
	"project_name": "C"
	"dependencies": ["B", "A"]
}

If A tries to add project C to its dependencies, it will pull down C’s publication artifact which includes itself in the dependencies → raise project cycle error.

If A tries to add project B to its dependencies, same thing.

If B tries to add project C to its dependencies, same thing.

Implementation Notes:
This could be done very early during parsing - as early as when publication artifacts are loaded, or could be deferred until compilation (assuming publication_dependencies are in the manifest) to keep a consistent location for cycle detection / error raising.