fix: express peer dependencies as ranges, drop unused dependencies

[saberzero1]

peerDependencies were pinned narrowly while the matching dependency moved forward, forcing consumers onto --legacy-peer-deps (#198, #144).

• obsidian was pinned to =1.8.7 as a peer while dependencies carried 1.12.3. It is never imported by lib/, so it moves to devDependencies and the peer is dropped; no-unsupported-api already reads the consumer's own obsidian.d.ts out of the TypeScript program.
• @eslint/js and @eslint/json are plain runtime dependencies, not peers, and no longer appear in peerDependencies.
• typescript is a runtime import in two rules, so it becomes a peer with an open-ended floor. An upper bound would only duplicate typescript-eslint's own ceiling and go stale the moment that widens.
• typescript-eslint stays a peer at its dependency range, because the recommended config registers the @typescript-eslint namespace and a second copy is a hard "Cannot redefine plugin" failure.

eslint, @types/eslint and @types/node were runtime dependencies despite being type-only or build-only, so they move to devDependencies. @eslint/core was imported by lib/index.ts without being declared at all.

eslint-plugin-depend and @eslint/json are registered under shared plugin namespaces, so their exact pins guaranteed a duplicate copy and the same "Cannot redefine plugin" error for any consumer using those plugins directly. Both now use a caret range.

eslint-plugin-security and eslint-plugin-json-schema-validator were declared but referenced nowhere in lib/, tests/ or the built output; the former also shadowed the copy @microsoft/eslint-plugin-sdl resolves for itself.

README now documents the obsidian devDependency, which the plugin previously supplied to consumers by accident through dependency hoisting.