Standardize approach to dependencies

[potiuk]

Approach to dependencies we had (especially with regards to
upper bounds) was pretty random so far. This PR attempts to
describe the rules discussed in the devlist discussion - including
review and update of all dependencies to match the policies.

---

^ Add meaningful description above

Read the Pull Request Guidelines for more information.
In case of fundamental code change, Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in UPDATING.md.

[potiuk]

I think that one is pretty read if we will be ok with introducing the policies as I proposed .

[ashb]

Lets see how this shakes out.

[github-actions]

The PR most likely needs to run full matrix of tests because it modifies parts of the core of Airflow. However, committers might decide to merge it quickly and take the risk. If they don't merge it quickly - please rebase it to the latest main at your convenience, or amend the last commit of the PR, and push it with --force-with-lease.

[potiuk]

Well. We do not really risk much. We can always limit troublesome deps if we find them troublesome.

We always have "escape hatch" -> use constraints.

Plus more and more people use images actually wich makes them naturally constrained to what we produce.

And we did not really had many of those in the first place actually.