fix: both koa and express are installed as transitive runtime dependencies

[jekh]

Description

Since koa and express were added to optionalDependencies in this commit, adding routing-controllers as a dependency now installs both koa and express as runtime dependencies. This unnecessarily bloats the runtime dependencies, and you can also end up with multiple versions of koa or express as runtime dependencies if your project depends on a koa/express version that is not compatible with routing-controller's koa/express semver range.

peerDependencies seems like a more natural fit for this use case:

In some cases, you want to express the compatibility of your package with a host tool or library, while not necessarily doing a require of this host. https://docs.npmjs.com/cli/v7/configuring-npm/package-json#peerdependencies

However, it sounds like npm v7+ will actually install all peerDependencies now:

In npm versions 3 through 6, peerDependencies were not automatically installed, and would raise a warning if an invalid version of the peer dependency was found in the tree. As of npm v7, peerDependencies are installed by default.

Since that would still result in both koa and express always being installed (but alleviate the version mismatch issue), it seems like reverting to devDependencies is the way go to.

A longer-term solution may be creating separate routing-controllers-koa and routing-controllers-express packages with peerDependencies on the respective framework and a regular dependencies dependency on a shared core functionality package.

Expected behavior

When adding routing-controllers to a project that uses express, koa is not installed, and vice versa.

Actual behavior

Both koa and express dependencies are always installed.