refactor: replace crypto-js

[exoego]

What kind of change does this PR introduce?
Closes #1637

Library Selection for crypto-js Replacement

Instead of large polyfill like crypto-browserify, I selected small, purpose-built libraries that cover what PDFKit needs.

Library	Purpose	Weekly Downloads	GitHub Stars	Notes
@noble/hashes	SHA-256	23M	800+	Actively maintained by famouse cipher researcher, synchronous API, tree-shakable
@noble/ciphers	AES-CBC/ECB	4.7M	300+	Same as above
js-md5	MD5	~570k	800+	Lightweight, browser/Node.js compatible. And mainly because @noble/* does not provided MD5 which is no longer secure
(added in this repo)	RC4	-	-	~25 lines, legacy PDF 1.3-1.5 only No actively maintained RC4 lib with browser support found 😭

Note that Web Crypto API provides SHA-256 digest and AES-CBC encryption but via asynchronous interface, which requires a big breaking change 💣

Checklist:

• Unit Tests
• Documentation
• Update CHANGELOG.md
• Ready to be merged

[blikblum]

Do you have an estimate what is the build size difference?

[exoego]

@blikblum Good question.
I have compared js/ directory after yarn build:

file	before (bytes)	after (bytes)
pdfkit.es.js	208,191	208,600 🔺
pdfkit.es.js.map	601,699	603,669 🔺
pdfkit.js	202,513	202,975 🔺
pdfkit.js.map	593,408	595,281 🔺
pdfkit.standalone.js	2,525,528	2,419,682 🔽

4.2% reduction in pdfkit.standalone.js while tiny size up in other files.
I think this increase is negligible.

[blikblum]

What matters is the standalone because the others do not include the dependencies. So the build size will be smaller when bundling in browser