dev dependencies VS hard dependencies cleanup

I originally added most dev dependencies inside the package.json as real dependencies, since workspaces (app repos) rely on using the same build tools. a bit more convenient, since we did not have to add them again.

However, tools like sonar will create alerts, security warnings & code smells for code which is only required for build processes. Whitelisting all errors is too much work.

So, we should move everything possible into devDependencies and also adjust npx neo-app to include them for new workspaces the same way.