golangci-lint: enable depguard to prevent re-introducing libcontainer

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

.golangci.yml

@@ -1,5 +1,6 @@
 linters:
   enable:
+    - depguard # Checks for dependencies that should not be (re)introduced. See "linter-settings" for further details.
     - exportloopref # Checks for pointers to enclosing loop variables
     - gofmt
     - goimports
@@ -52,6 +53,17 @@ issues:
       text: "redefines-builtin-id"
 
 linters-settings:
+  depguard:
+    rules:
+      main:
+        allow:
+          # TODO(thaJeztah): remove this once we updated CDI with https://github.com/cncf-tags/container-device-interface/pull/158 included
+          - github.com/opencontainers/runc/libcontainer/devices
+          - github.com/opencontainers/runc/libcontainer/user
+        deny:
+          - pkg: github.com/opencontainers/runc
+            desc: We don't want to introduce more dependencies on runc (libcontainer), unless there is no other option.
+
   gosec:
     # The following issues surfaced when `gosec` linter
     # was enabled. They are temporarily excluded to unblock