RFC 697: Update tooling to keep out-of-band migration isolated

Created by: efritz

See RFC 697: Multiple version upgrades.

Provide tooling locally/in CI to ensure that out-of-band migrations do not import a package that make running them in the migrator service (without a full instance running) more burdensome to the end user. This could be done via a new in-tree Go module that cannot import internal, depgraph, or another type of linting pass that catches such imports and fails the build.