Mark all dependencies as private and not exported to upstream projects, with exception of spdlog

[TimEvens]

By default, all dependencies should not be available to upstream projects that use libquicr. The only exception is spdlog, which needs to be documented as being available and will not change. Repos that use spdlog will need to have some assurance that spdlog is available and they can use.

[GhostofCookie]

I think based on recent conversations that we don't want spdlog exposed anymore either.