chore: add scripts/update-otel-deps.js to carefully handle updating @opentelemetry/* deps

[trentm]

The motivation here was that dependabot doesn't handle this group update for
a repo using npm workspaces (see #58
and experiences with opentelemetry-js-contrib, open-telemetry/opentelemetry-js-contrib#1917)

---

David, I'm not sure how closely you care to review this. I'll do a separate PR that actually uses this to update our OTel deps. I've been testing this some with opentelemetry-js-contrib as well for open-telemetry/opentelemetry-js-contrib#1917 -- which is where some of the defensive coding comes from.

[trentm]

Here is an example run:

% ./scripts/update-otel-deps.js
Updating deps matching "@opentelemetry/*" in 3 workspace dirs

Gathering info on outdated deps in each workspace:
 - packages/opentelemetry-node (1 of 3)
 - packages/mockotlpserver (2 of 3)
 - examples (3 of 3)

Performing updates (2 `npm install ...`s, 1 `npm update ...`):
 $ cd packages/opentelemetry-node && npm install @opentelemetry/[email protected] @opentelemetry/[email protected] @opentelemetry/[email protected] @opentelemetry/[email protected] @opentelemetry/[email protected] @opentelemetry/[email protected]
 $ cd packages/mockotlpserver && npm install @opentelemetry/[email protected] @opentelemetry/[email protected] @opentelemetry/[email protected] @opentelemetry/[email protected]
 $ npm update @opentelemetry/resources @opentelemetry/sdk-metrics

Sanity check that all matching packages are up-to-date:
 $ npm outdated @opentelemetry/exporter-logs-otlp-proto @opentelemetry/exporter-metrics-otlp-proto @opentelemetry/host-metrics @opentelemetry/instrumentation-express @opentelemetry/instrumentation-http @opentelemetry/resources @opentelemetry/sdk-node @opentelemetry/api @opentelemetry/exporter-trace-otlp-grpc @opentelemetry/exporter-trace-otlp-http @opentelemetry/exporter-trace-otlp-proto @opentelemetry/instrumentation-bunyan

Summary of changes (possible commit message):
--
chore(deps): update deps matching "@opentelemetry/*"

    0.34.1 -> 0.35.0 @opentelemetry/host-metrics (range-bump)
    0.34.1 -> 0.35.0 @opentelemetry/instrumentation-express (range-bump)
    0.47.0 -> 0.48.0 @opentelemetry/exporter-logs-otlp-proto (range-bump)
    0.47.0 -> 0.48.0 @opentelemetry/exporter-metrics-otlp-proto (range-bump)
    0.47.0 -> 0.48.0 @opentelemetry/exporter-trace-otlp-grpc (range-bump)
    0.47.0 -> 0.48.0 @opentelemetry/exporter-trace-otlp-http (range-bump)
    0.47.0 -> 0.48.0 @opentelemetry/exporter-trace-otlp-proto (range-bump)
    0.47.0 -> 0.48.0 @opentelemetry/instrumentation-http (range-bump)
    0.47.0 -> 0.48.0 @opentelemetry/sdk-node (range-bump)
    1.20.0 -> 1.21.0 @opentelemetry/resources
--

[david-luna]

I'm not ad proficient as you on npm mechanic but I see you did this PR thoroughly. I left some comments since I saw potential to use it more as a CLI tool than a specific script in our repo.

I wouldn't mind to type from time to time

node ./scripts/update-deps.js @opentelemetry/* true

and even have a dry-run mode to check before actually doing the changes.

[david-luna]

if patterns is not defined this script will try to update all dependencies right? I think maybe is better the script requires at least one pattern so changes made by it are focused in scope. This means also to not allow the wildcard pattern to match all.

[trentm]

Added a guard in commit 8c3c9f9. I'm not guarding against passing in * for now.

[david-luna]

nit: the condition allowRangeBumpFor0x === false && semver.lt(currVer, '1.0.0') falls in this else block. We may want to tell the user that he/she can enable the flag to get an update.

[trentm]

Commit 8c3c9f9

[trentm]

node ./scripts/update-deps.js @opentelemetry/* true

and even have a dry-run mode to check before actually doing the changes.

I am not generalizing the options out to command-line options for now, because:

• I want to keep this as targeted as possible, at least for now, because I hope to use basically this same script with opentelemetry-js-contrib.js once updating @opentelemetry/* deps is currently problematic open-telemetry/opentelemetry-js-contrib#1917 is resolved.
• My hope is that dependabot will suffice for all other dep version updates, so that we'll never need to use this with a value other than patterns: ['@opentelemetry/*']. If so, then the targeted update-otel-deps.js is simpler.