chore: remove unused dependencies

[jsjoeio]

This PR removes unused dependencies.

Process

To do this, we use a tool called depcheck. Locally, I ran npx depcheck --ignore-patterns=lib,dist,coverage,contrib which gave the following output:

Unused dependencies
* argon2
* env-paths
* node-fetch
* pem
* safe-buffer
* safe-compare
* tar-stream
* xdg-basedir
Unused devDependencies
* @types/pem
* @types/safe-compare
* @types/tar-stream
* @types/wtfnode
* audit-ci
* doctoc
* eslint-import-resolver-alias
* leaked-handles
* prettier-plugin-sh
* shellcheck
* stylelint
* stylelint-config-recommended
* wtfnode
Missing dependencies
* express-serve-static-core: ./typings/pluginapi.d.ts

Most of these are false-positives. I've identified the ones we no longer used and removed them as part of this PR. I've corrected this list and added more about how we use each dependency:

False positives
* @types/pem
* @types/safe-compare
* @types/tar-stream
* argon2 - used to hash passwords
* doctoc - used to generate table of contents in .md files
* audit-ci - used to identify vulnerabilities as part of CI
* env-paths - used to get environment paths
* pem - used to generate certificates 
* safe-compare - used to check if legacy hash & password are a match
* xdg-basedir - used when determining environment paths
* prettier-plugin-sh - formats shell files with prettier
* shellcheck - used to lint shell files
* stylelint - used for linting
* stylelint-config-recommended - used for linting

Moved Dependencies
* @types/wtfnode
* node-fetch - used as a testing dependency (moved out of root `package.json`) 
* wtfnode - used as a testing dependency (moved out of root `package.json`) 

Removed
* safe-buffer
* tar-stream
* leaked-handles
* eslint-import-resolver-alias

Other
* express-serve-static-core: ./typings/pluginapi.d.ts - found a comment [here](https://github.com/cdr/code-server/blob/main/.eslintrc.yaml#L39) which says "This isn't a real module, just types, which apparently doesn't resolve"

Fixes #3423

[codecov]

Codecov Report

Merging #3729 (0088dd6) into main (6f7ae29) will not change coverage.
The diff coverage is n/a.

❗ Current head 0088dd6 differs from pull request most recent head 0b072e7. Consider uploading reports for the commit 0b072e7 to get more accurate results

@@           Coverage Diff           @@
##             main    #3729   +/-   ##
=======================================
  Coverage   61.55%   61.55%           
=======================================
  Files          35       35           
  Lines        1813     1813           
  Branches      365      365           
=======================================
  Hits         1116     1116           
  Misses        588      588           
  Partials      109      109           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6f7ae29...0b072e7. Read the comment docs.

[jawnsy]

I always ❤️ this kind of spring cleaning, thanks for doing it! 🧹 And thanks also for making sure our test suite covers enough that we can feel confident doing this, Joe!

[jsjoeio]

Oh no...I think i broke something by removing eslint-import-resolver-alias