feat: replace elliptic fallback with @noble/curves

[fully-autonomous]

Replaces the JS fallback implementation (lib/elliptic.js) with a new implementation backed by @noble/curves/secp256k1 (lib/noble.js).

Motivation

The elliptic package has an open vulnerability (GHSA-848j-6marx-7j84) with no patched release published. Every downstream user of secp256k1 that falls back to the JS path (e.g. environments where native bindings fail to compile) inherits this vulnerability with no available fix.

@noble/curves uses audited, constant-time implementations and is actively maintained by Paul Miller. It is already a transitive dependency of many projects in this space (ethers v6, viem, etc.).

What changes

• New lib/noble.js implements the same low-level interface as lib/elliptic.js using @noble/curves/secp256k1
• elliptic.js entry point now loads lib/noble instead of lib/elliptic
• elliptic dependency replaced with @noble/curves in package.json
• lib/elliptic.js is left in place (no breaking change to the file layout)

Why drop elliptic entirely vs. keeping as secondary fallback

This package already requires node >=18.0.0. BigInt has been available since Node 10.4 (2018), so there is no environment supported by this package that lacks BigInt. Keeping elliptic as a secondary fallback would mean the vulnerability remains in the dependency tree for all users.

Test results

All 221 tests pass against the new implementation.

Note: there is an existing PR #210 taking a similar approach using @noble/secp256k1. This PR uses @noble/curves (the current maintained package — @noble/secp256k1 is legacy) and removes elliptic entirely rather than keeping it as a fallback.