Replace `sha1` npm package with inline implementation (#1465)

Fixes #1464

The `sha1` npm package references `Buffer.isBuffer()` internally. Bundlers like webpack/Next.js see this and inject a **~28 KB Buffer polyfill** into every client page — even though the `Buffer` code path is never reached (we only hash short strings)

On top of that, `sha1` only ships CommonJS, forcing CJS interop on every bundler that consumes the ESM dist

- Remove `sha1` and `@types/sha1` dependencies
- Add a ~90-line inline SHA-1 (FIPS 180-4) that only handles UTF-8 strings — which is all the tracker needs
- Tests cover RFC 3174 vectors plus the actual domain-hash values to ensure identical output

- **-28 KB raw / ~7 KB gzipped** from every page for Next.js / webpack 5 users
- Eliminates the last CJS dependency in `browser-tracker-core`
- No API or behavioral changes