[dduugg]

• Moves tempfile to [dev-dependencies]. Only the unit tests in src/ and the tests in tests/ use it, but as a normal dependency it reached every crate that depends on codeowners. So did eight crates that only it pulls in: rustix, linux-raw-sys, getrandom, wasip2, wit-bindgen, errno, fastrand and r-efi.
• This matters for the code_ownership gem, which runs cargo vendor into its source gem and so ships all nine crates' sources. Three of them, rustix, linux-raw-sys and wit-bindgen, include a LICENSE-Apache-2.0_WITH_LLVM-exception file. License scanners such as Socket flag that file even though each crate is also offered under MIT.
• Removes clap_derive. It was a direct dependency that nothing names, and clap's derive feature already depends on it, so the only change it makes is one line in Cargo.lock.
• The version stays at 0.5.0, so merging releases nothing.

Verification

• With --locked, all of these pass: cargo check, cargo build --release, cargo fmt --all -- --check, cargo clippy --all-targets --all-features -- -D warnings and cargo test. The tests report 178 passed and 3 ignored.
• I moved each remaining [dependencies] entry to [dev-dependencies] in turn and ran cargo check --lib --bins. Every other dependency is needed by the library or binary. clap_derive was the only entry that also compiled with --all-targets when removed outright.
• With code_ownership's extension patched to this branch, cargo vendor goes from 120 crates to 111. It loses exactly the nine above and adds none. unicode-ident stays, with its Unicode-3.0 license file, because proc-macro2 needs it for derive macros.