Add standard for taking a new dependency

[baldawar]

What is your idea?

Follow up from #55 (comment)

Do we have a standard about adopting dependencies? I remember doing quite a bit of work inside AWS to convince myself/others that a dependency was acceptable.
...
We don't have a standard today

We can use this issue to aggregate opinions and prior art from similar libraries.

Would you be willing to make the change?

No

Additional context

We can update https://github.com/aws/event-ruler/blob/main/CONTRIBUTING.md with some standard guidance on when it is okay to take a new dependency.