New rule: `no-unused-dependencies`

The thought here is that this rule would lint *`package.json` itself* and warn on any deps or dev deps that are not explicitly imported somewhere in the linted JS files.

This would be independently configurable for deps as well as dev deps, with the following example schemas:
```json
[2, {
"dependencies": false,
"devDependencies": true
}]
```

```json
[2, {
"dependencies": {
"enable": false
},
"devDependencies": {
"ignore": ["something-side-effecty", "a command-line tool"]
}
}]
```

Ideally, it would also *not* warn on unused dev deps that had a "bin" name that was explicitly referenced in any of the "scripts".

No files, tests, or entry points are named. Start by examining the plugin's existing rule and configuration patterns, then define how package.json dependencies, devDependencies, ignored packages, and script-referenced binaries should be detected. Done means the proposed rule and schemas cover the stated cases without false positives.

Written by the indexing model from the issue text.