chore: Update dev deps specifiers

[vdusek]

• Switch from tilde version constraints to using only an upper major version bound. Since the lockfile already pins exact versions, the tilde constraint is unnecessary and causes frequent (and unnecessary) Renovate PRs.
• Use major-only upper-bound version specifiers for most development dependencies.
• Keep the tilde specifier for Ruff and Mypy, since even minor updates can—and often do—break CI.