Add guidelines for dependencies

[mcmire]

• When to use dependencies, devDependencies, and peerDependencies for controllers
  • If your controller is talking to another controller via the messenger, you should place that controller in both devDependencies and peerDependencies. (Explain why.) This trumps all other rules.
    • Furthermore, the version range in peerDependencies should be set to the major to reduce the coupling between packages and makes upgrades in clients easier.
  • If you are importing a controller in production code, then you should place that controller in dependencies. Yes, this even includes types (because types show up in the published version of the package.)
  • If you are importing a controller in tests only, then you should place that controller in devDependencies.

[mcmire]

Also see: https://github.com/MetaMask/contributor-docs/issues/117