Add MainThreadToken to ensure file-dialogs only run on the main thread

[emilk]

What

We have a foot-gun in our code: our file dialogs (via rfd) are only allowed to be run from the main thread (at least on Mac).
However, there is nothing stopping a user from accidentally calling these functions from a background thread, and if you test it on e.g. Linux, it may very well work.

So this PR introduces a new crate re_capabilities and a new type MainThreadToken. Any function that uses rfd should require the MainThreadToken as an argument. The MainThreadToken is only allowed to be created in fn main, and since it is neither Send nor Sync, this guarantees at compile-time that any functions that take a MainThreadToken can only be called from the main thread.

NOTE: I have no way to enforce that all uses of rfd also require MainThreadToken - we need to remember this ourselves, but I've made sure that all our current uses of rfd require a MainThreadToken.

[github-actions]

Web viewer built successfully. If applicable, you should also test it:

• I have tested the web viewer

Result	Commit	Link	Manifest
✅	611462d	https://rerun.io/viewer/pr/8467	+nightly +main

^{Note: This comment is updated whenever you push a commit.}

[jprochazk]

If we make the i_promise_i_am_on_the_main_thread function into something that actually enforces the invariant, and we don't have any way to bypass it, then I think this could work. But as it is, it's better than nothing, even if it depends on manual review 🤷