autoremove: cross-check candidates against formula definitions

The forward dependency check in `removable_formulae` relies on tab data
(INSTALL_RECEIPT.json) which becomes stale when homebrew-core adds new
dependencies to a formula. Cross-check autoremove candidates against
current formula definitions by calling `runtime_formula_dependencies`
with `read_from_tab: false` on non-candidate formulae. The check
iterates until convergence to handle cascading dependencies and falls
back gracefully on error.

Fixes #21511