Wp-calypso: Add an eslint rule to forbid adding `devDependencies` in packages

[simison]

If adding devDependencies to package.json in packages/apps can cause trouble (see e.g. https://github.com/Automattic/wp-calypso/pull/32383), we'll need an Eslint rule to stop folks doing this.

Monorepo docs say:

The only exception are devDependencies which must be declared in the wp-calypso root package.json. devDependencies of sub-packages in a monorepo are not reliably installed and cannot be relied on.

Note also conflicting import/no-extraneous-dependencies rule in packages (https://github.com/Automattic/wp-calypso/pull/32294#discussion_r276495780)

FYI @Automattic/team-calypso

[griffbrad]

I'll give this a shot. Looks like the no-extraneous-dependencies rule is actually a decent model for what we need.

[stale[bot]]

This issue has been marked as stale and will be closed in seven days. This happened because:

• It has been inactive in the past 9 months.
• It isn't a project or a milestone, and hasn’t been labeled `[Pri] Blocker`, `[Pri] High`, `[Status] Keep Open`, or `OSS Citizen`.

You can keep the issue open by adding a comment. If you do, please provide additional context and explain why you’d like it to remain open. You can also close the issue yourself — if you do, please add a brief explanation.

[blowery]

I think we're still working on this. Should be made easier / proper by https://github.com/Automattic/wp-calypso/pull/38190

[jsnajdr]

Big part of this issue was solved in #36534 by @simison himself when he added the npm-package-json-lint linter and enabled its prefer-no-devDependencies rule. But the config still allows adding dev depenencies to the apps/*/package.json files.

I pushed a commit to #38190 (its sha is https://github.com/Automattic/wp-calypso/pull/38190/commits/ae80bab17440c4ed83a392d9ae89c6682d5419fd as I write this, but will change after the next rebase) that modifies the linter config to allow dev dependencies only in the root package.json.