Docs/dependency review standards

[emmyoat]

Summary

Adds a comprehensive dependency review document (docs/dependency-review.md) defining standards for reviewing, adding, updating, and justifying third-party dependencies in the Stellar PocketPay SDK.

Key Changes

• New Document (docs/dependency-review.md):
  • Core Philosophy: Minimal runtime footprint, high bar for approval, supply chain security, zero bloat.
  • Criteria for Adding Dependencies: Runtime (dependencies) vs DevDependencies, purpose justification, maintenance health, security risk evaluation (zero CVEs), transitive weight, alternative analysis (native implementation vs package), and license compliance (MIT, Apache 2.0, BSD).
  • Criteria for Updating Dependencies: Automated patch/minor updates, major version breaking change protocols, and emergency CVE patch procedures.
  • Review Workflow: Requirements for PR submitters, lockfile integrity, and maintainer sign-off.
• README Update (README.md): Added link to Dependency Review Standards in the Documentation sitemap.
• Contributor Guide Update (CONTRIBUTING.md): Updated code style and dependency guidelines to reference docs/dependency-review.md.

[El-swaggerito]

This PR cannot be merged automatically because it has merge conflicts.

Please update the branch with the latest base branch and resolve the conflicts.

After the conflicts are resolved and checks pass, the automation can review it again.