Zero dependencies for JS SDK

[davidmytton]

Remove all external dependencies from the SDK so we can claim "you only add 1 additional dependency to your application" when you install the Arcjet SDK.

[davidmytton]

Feasibility assessment:

• A standard adapter install currently brings in four third-party runtime packages: @bufbuild/protobuf, @connectrpc/connect, @connectrpc/connect-node, and @connectrpc/connect-web.
• @bufbuild/protobuf is only a test-time direct dependency of @arcjet/transport, so that declaration can move to devDependencies; it would remain installed transitively.
• The practical incremental path is to replace connect-node and connect-web with an Arcjet-owned transport for the unary Connect subset used by Decide and Report, while retaining Connect core and the protobuf runtime.
• Removing Connect core and Buf entirely would require owning Connect framing/error semantics plus protobuf serialization and generated runtime support, so that is a substantially larger project.
• Reaching one lockfile entry also requires bundling the internal @arcjet/* packages; dependency removal alone cannot achieve that while Bundle all @arcjet/* dependencies into package #4341 remains not planned.

#6221 adds the wire-contract and real-runtime characterization coverage needed before replacing connect-node and connect-web. It covers Node HTTP/2 and Fetch HTTP/1.1 success, empty responses, errors, deadlines, cancellation, request cleanup, and successful native Bun/Deno calls.