chore: fix grpc and proto-loader deps

[seemk]

• Remove unused @grpc/proto-loader dependencies or move them to dev deps where possible.
• Update grpc-js and proto-loader versions: most of the packages contain grpc-js with ^1.5.9 versioning, which might install (currently) up to grpc-js 1.7, which depends on proto-loader 0.7.x. However proto-loader dependencies were pinned to patch versions, this would cause duplicate proto-loader package installs.
• Remove exact grpc-js and proto-loader versions from opentelemetry-instrumentation-grpc.

[codecov]

Codecov Report

Merging #3337 (93b51e3) into main (292a53d) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3337   +/-   ##
=======================================
  Coverage   93.47%   93.47%           
=======================================
  Files         244      244           
  Lines        7325     7325           
  Branches     1515     1515           
=======================================
  Hits         6847     6847           
  Misses        478      478           

[Flarna]

Is @grpc/proto-loader needed in the dev dependencies even @grpc/grpc-js is a dependency?
I thought @grpc/grpc-js ensures that the correct/matching version of @grpc/proto-loader is installed

[seemk]

Since test code requires it explicitly, can we be sure @grpc/grpc-js will depend on it in the future? It might introduce potential breakage 🤔

[dyladan]

if we depend on a package directly then it should be in the package.json. Even if it is transitively required by another package npm handles the dedupe when required.

[Flarna]

If it is within our dependency dedupe might fail if ranges don't match. Usually we pin our dev deps (otherwise renovate bot complains) which doesn't match to what grpc-js does.

Anyhow I agree it's better to add what we need and update in sync with grpc-js. Maybe renovate bot can support here but I guess it's not so easy to configure it for our needs.