Breaking - stop publishing dual packages

We can publish ESM only now that consumers can `require(esm)` since Node.js 20 which is the maintenance LTS now.

And technically, even older Node.js can consume ESM with `await import(esm)` so while it might be breaking, its still available if the consumer is willing to use async/await.

See https://socket.dev/blog/require-esm-backported-to-node-js-20