Tracking of external deps in root manifest

[Morganamilo]

When an external dependency is bumped in the root manifest file, parity publish has no way to see this. The PR author must correctly declare all packages that the dep change effects.

If they are not declared, then the effected packages won't be marked for release. This is a big issue when the external dependency is visible in our public API.

This happened during the 1.14 release. One package using an external dep never got marked for release while another did. When publishing, eventually we got to a package depending on both. This caused a failure due to two incompatible versions of a library being used.