Remove node-fetch from dependencies

[andynaguyen]

Summary

statsig-node@6.5.2 still declares node-fetch@^2.7.0 as a production dependency.

The current safeFetch.ts attempts to load node-fetch in every non-edge environment and only falls back to the global fetch implementation when that import fails. Because node-fetch is installed by default, modern Node runtimes never use their native Fetch API.

Could statsig-node use globalThis.fetch on supported modern Node versions and remove node-fetch from the default dependency graph?

Motivation

Node 18 and newer provide a built-in Fetch API. Keeping node-fetch@2 in the default runtime path:

• Adds node-fetch, whatwg-url, tr46, and webidl-conversions to serverless bundles.
• Increases Lambda bundle size and cold-start module-loading work.
• Can surface warnings from older transitive dependencies on newer Node versions.
• Causes the SDK to use a second Fetch implementation even when the runtime already provides one.
• Makes bundlers retain the dependency because of the static require("node-fetch").

This is related to #48, but the requested change is to use the native runtime implementation rather than update node-fetch to another version. Node 18 is considered EOL already - most users of the package should be on a runtime with built-in Fetch API.

Proposed behavior

1. Use globalThis.fetch directly.
2. Remove node-fetch and its type package from the production dependency graph.
3. Preserve the existing retry, abort-signal, request-body, and response-handling behavior.

Acceptance criteria

• node-fetch is no longer a production dependency of the modern Node entry point.
• Initialization, config synchronization, ID-list downloads, event logging, retries, and shutdown aborts are tested against native fetch.
• Bundling a basic statsig-node consumer on a modern Node target does not include node-fetch or its transitive URL packages.
• The minimum supported Node version or legacy fallback strategy is documented.