The extra package is a dependency and hlint's extra group is enabled

## Summary

Add `extra` to the library's `build-depends` and turn on the hlint `extra`
group in `.hlint.yaml`.

## Motivation

#116 surveyed the group and left it off, on the grounds that every hint in it
rewrites toward functions from the `extra` package and enabling it would push
contributors to add a dependency for stylistic sugar. Adopting the dependency
deliberately removes that objection: the vocabulary becomes available to write
against, and hlint enforces it instead of leaving each contributor to remember
it.

## Scope

- Add `extra` to the `network-arbitrary-common` stanza's `build-depends` with a
PVP bound.
- Replace the `extra`-group note in `.hlint.yaml` with
`- group: {name: extra, enabled: true}`.
- Apply any hints that fire, or record per-hint ignores with reasons.

## Acceptance criteria

- [ ] `extra` appears in `build-depends` with a bound covering the supported GHC range.
- [ ] `.hlint.yaml` enables the `extra` group and no longer explains why it is off.
- [ ] `hlint src test` is green.
- [ ] CI passes across the GHC matrix.

## Additional context

Two costs worth deciding against, both measured rather than assumed:

**The group fires nothing today.** Surveying `extra` against `src/` and `test/`
at `81b2a73` produced zero hits, with group loading proven by a probe rather
than inferred from the empty result (`maybe (pure ()) print` → `whenJust`
fires). So this buys no cleanup now; its value is prospective enforcement on
code not yet written, across four modules totalling roughly 250 lines.

**The dependency footprint is wider than the current set.** `extra-1.8.1`
depends on `directory`, `filepath`, `process`, `clock`, `time`, and `unix`.
Today the library depends on `base`, `bytestring`, `http-media`, `http-types`,
`network-uri`, and `QuickCheck`, none of which pull in `process` or `unix`.
Consumers take this on transitively — softened, but not removed, by
network-arbitrary being a test-support library that usually lands in a
consumer's test-suite stanza rather than its library stanza.

`extra-1.8.1` resolves against base 4.22, so the current GHC matrix is not a
blocker.

Reverses the `extra` half of #116; the `partial` and `partial-strict` half
lands in #140. alunduil/collection-json.hs#171 tracks the same question for the
sibling repo and is still open, so landing this one first would split the two
repos' lint configuration until that one follows.