[utils] Drop the `web3` devDependency and replace the differential unit conversion test

[cryptodev-2s]

packages/utils declares web3@^4.16.0 as a devDependency. It backs exactly one test out of 78 in src/unitsConversion.test.ts, a randomised differential check of toWei and fromWei against web3's implementations. Nothing else in the package imports it.

It is not cheap. It came in with the migration (#10185) and added 42 of the 43 new entries in yarn.lock, 19 of them web3-* packages, roughly 3.5MB in node_modules. Every Socket Security alert on that PR traced back to it, ten in all, two of them blocking.

The fromWei half of the test earns very little for that price:

// skips the cases where web3 itself is wrong
if (web3Value.includes('-') && !web3Value.startsWith('-')) {
  return;
}

const unitsValueAsNumber = parseFloat(unitsValue);
const web3ValueAsNumber = parseFloat(web3Value);

const tolerance = 1e-10;
expect(Math.abs(unitsValueAsNumber - web3ValueAsNumber)).toBeLessThan(tolerance);

It skips the inputs where web3 has a known formatting bug, then compares through parseFloat with a 1e-10 tolerance. At wei scale parseFloat cannot represent that precision, so the assertion passes on values it should not.

Proposal: replace the differential test with fixed vectors covering the same ground (every unit in unitMap, negatives, boundaries, round tripping) and drop the web3 devDependency. That removes 42 packages from the tree and all ten Socket alerts.

Worth doing alongside #10209, which fixes a real toWei bug in the same file.