…age (#19176)

The need to call this function is referenced in the README, but if you
already have written custom steps you're not going to read the README
again.

Include the same hints in the error message.

Fixes #19173.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This adds a new section to the contributing guide that details how to
introduce an "unconventional" dependency. It also adds a new section to
the PR template that asks the submitter to verify whether their PR adds
any dependencies.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

The policies we generate sometimes have a lot of duplication between
statements. This duplication can lead to the policy going over the size
limit an IAM policy (either 2k, 6k or 10k bytes, depending on the resource
type).

This change combines multiple statements together, as long as it
doesn't change the meaning of the final policy.

Because doing so for all existing stacks will probably provoke minor
heart attacks in operators everywhere, the new behavior is gated
behind a feature flag. It can be retroactively switched on by
people currently being bit by the size issues:

```
@aws-cdk/aws-iam:minimizePolicies
```

We will merge 2 statements if their effects are the same, and they are otherwise exactly the same apart from their `Action`, `Resource` or `Principal` declarations. We will not merge `NotXxx` statements, because doing so will change the meaning of the statement (`not A or not B ≠ not (A or B)`). There may be multiple possible merges that apply and we are not guaranteed to find the smallest merging, nor do we take effort to find all possible merges and do simplifications like `*`-subsumption. This is a starting point that should help out in the common case.

Fixes #18774, fixes #16350, fixes #18457, fixes #18564, fixes #19276.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

Fixes #19382


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Right now, we advertise `alpha` packages for every service module that
is marked as `experimental`.

However, all L1-only packages are all always marked as `experimental` as
a protection against human mistakes: so that when we add in L2s we don't
accidentally mark them as `stable` right away.

This leads to every CFN-only package having an advertising clause for
an `alpha` package that doesn't even exist.

Do a source code check to only advertise if it looks like there are
actual L2s.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Co-authored-by: Chris Garvis <cgarvis@gmail.com>
Co-authored-by: Rico Huijbers <rix0rrr@gmail.com>
Co-authored-by: Christopher Rybicki <rybickic@amazon.com>

Also removes an unnecessary dependency on having no messages on a stack, since additional messages can be introduced in the future. Related #19465.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*