Some nodes should have no public libdeps, such as mongod_main, and we can use a tag to programmatically enforce that.

Implement such a rule and add the tag to the correct nodes in the build.