Have a pass to reduce dupe packages at different versions where possible (eg `syn`)

So we addressed part of #1503 by removing derive_more, but we still have syn 1 and 2 still.

Duplicated dependencies by running $ cargo-guppy dups with all features

• frame-metadata (16.0.0, 17.0.0)
• impl-codec (0.6.0, 0.7.0)
• regex-syntax (0.6.29, 0.8.5)
• object (0.30.4, 0.32.2)
• toml_edit (0.21.1, 0.22.12)
• ark-serialize (0.3.0, 0.4.2)
• windows_i686_gnu (0.42.2, 0.48.5, 0.52.5)
• hashbrown (0.12.3, 0.13.2, 0.14.5)
• fallible-iterator (0.2.0, 0.3.0)
• windows_aarch64_msvc (0.42.2, 0.48.5, 0.52.5)
• windows_x86_64_gnu (0.42.2, 0.48.5, 0.52.5)
• primitive-types (0.12.2, 0.13.1)
• ark-ff-macros (0.3.0, 0.4.2)
• bitflags (1.3.2, 2.5.0)
• linux-raw-sys (0.1.4, 0.4.13)
• ahash (0.7.8, 0.8.11)
• toml (0.8.12, 0.5.11)
• secrecy (0.8.0, 0.10.2)
• windows_x86_64_msvc (0.42.2, 0.48.5, 0.52.5)
• derive_more (0.99.17, 1.0.0)
• syn (1.0.109, 2.0.77)
• hermit-abi (0.3.9, 0.4.0)
• zstd-safe (5.0.2+zstd.1.5.2, 6.0.6)
• sha2 (0.9.9, 0.10.8)
• polkavm (0.9.3, 0.10.0)
• zstd (0.11.2+zstd.1.5.2, 0.12.4)
• ark-ff (0.3.0, 0.4.2)
• ark-ff-asm (0.3.0, 0.4.2)
• itertools (0.10.5, 0.11.0, 0.13.0)
• send_wrapper (0.4.0, 0.6.0)
• windows_i686_msvc (0.42.2, 0.48.5, 0.52.5)
• polkavm-derive (0.10.0, 0.9.1)
• winnow (0.5.40, 0.6.7)
• polkavm-derive-impl (0.10.0, 0.9.0)
• hmac (0.12.1, 0.8.1)
• windows_x86_64_gnullvm (0.42.2, 0.48.5, 0.52.5)
• polkadot-primitives (15.0.0, 16.0.0)
• digest (0.10.7, 0.9.0)
• impl-serde (0.4.0, 0.5.0)
• windows-targets (0.42.2, 0.48.5, 0.52.5)
• heck (0.4.1, 0.5.0)
• indexmap (1.9.3, 2.2.6)
• event-listener (4.0.3, 5.3.0)
• secp256k1 (0.28.2, 0.29.1)
• rustix (0.36.17, 0.38.34)
• block-buffer (0.9.0, 0.10.4)
• base64 (0.13.1, 0.21.7, 0.22.1)
• event-listener-strategy (0.4.0, 0.5.2)
• windows_aarch64_gnullvm (0.42.2, 0.48.5, 0.52.5)
• polkavm-common (0.10.0, 0.9.0)
• addr2line (0.19.0, 0.21.0)
• arrayvec (0.4.12, 0.7.4)
• windows-sys (0.45.0, 0.48.0, 0.52.0)
• polkavm-assembler (0.9.0, 0.10.0)
• uint (0.9.5, 0.10.0)
• gimli (0.27.3, 0.28.1)
• polkavm-linux-raw (0.9.0, 0.10.0)
• regex-automata (0.4.8, 0.1.10)
• ark-std (0.3.0, 0.4.0)
• bitcoin_hashes (0.13.0, 0.11.0)
• secp256k1-sys (0.9.2, 0.10.1)
• sp-staking (34.0.0, 36.0.0)
• polkavm-derive-impl-macro (0.10.0, 0.9.0)
• lru (0.8.1, 0.12.3)
• constant_time_eq (0.1.5, 0.3.0)

Duplicated dependencies without substrate

• syn (1.0.109, 2.0.77)
• block-buffer (0.9.0, 0.10.4)
• constant_time_eq (0.1.5, 0.3.0)
• arrayvec (0.4.12, 0.7.4)
• bitcoin_hashes (0.14.0, 0.13.0)
• regex-syntax (0.6.29, 0.8.5)
• event-listener (4.0.3, 5.3.0)
• base64 (0.13.1, 0.22.1)
• hmac (0.12.1, 0.8.1)
• digest (0.10.7, 0.9.0)
• derive_more (0.99.17, 1.0.0)
• regex-automata (0.4.8, 0.1.10)
• send_wrapper (0.4.0, 0.6.0)
• bitflags (1.3.2, 2.5.0)
• event-listener-strategy (0.4.0, 0.5.2)
• hex-conservative (0.2.1, 0.1.1)
• sha2 (0.9.9, 0.10.8)

Duplicated dependencies without light-client and substrate

• bitcoin_hashes (0.14.0, 0.13.0)
• syn (1.0.109, 2.0.77)
• bitflags (1.3.2, 2.5.0)
• hex-conservative (0.2.1, 0.1.1)
• regex-syntax (0.6.29, 0.8.5)
• regex-automata (0.4.8, 0.1.10)

Start by running cargo-guppy dups with all features, then compare the reported duplicates with the three dependency lists in this issue. Investigate which listed version pairs can be consolidated without substrate or feature-set incompatibilities; done means reducing the applicable duplicate packages and updating the checklist.