🌱 Add verify-import-restrictions to enforce import restrictions

[laozc]

What this PR does / why we need it:
This PR adds verify-import-restrictions to enforce import restrictions on API packages
to prevent regression mentioned in #9011.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

[laozc]

/area api

[k8s-ci-robot]

@laozc: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-apidiff-main	0e96cc4	link	false	/test pull-cluster-api-apidiff-main

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[sbueringer]

/approve

Looks good to me thx. Let's get this PR in first, then we can do the same for other packages

/assign @chrischdi @killianmuldoon

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chrischdi]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 227569594f571c8a2445a99aeb2a5c05d6c11399

[mdbooth]

FYI, this looks like it duplicates the functionality of the golangci module depguard. I believe this is a standard module, as I had to disable it in CAPO when updating to golangci-lint-1.54.

[sbueringer]

I think we had depguard enabled in the past (but didn't actually use it) but dropped it for some reason.

Now we're using the same as k/k

@killianmuldoon @chrischdi Do you remember why we removed depguard from the enabled linter list?

[chrischdi]

I think we had depguard enabled in the past (but didn't actually use it) but dropped it for some reason.

Now we're using the same as k/k

@killianmuldoon @chrischdi Do you remember why we removed depguard from the enabled linter list?

TLDR: we did not configure it and beginning with a golangci lint version it would have required us to add some config. So we removed the linter instead because we obviously did not use it.

Source:

Removed depguard which now requires a default config with all of the dependencies allowed or disallowed.

#8796