fix(security): drop unused @serverless/utils production dependency

@serverless/utils was declared in dependencies but never imported at
runtime. It was the only consumer-facing path to decompress@4.2.1
(GHSA-mp2f-45pm-3cg9 / CVE-2026-53486), which has no upstream patch.
Removing it clears decompress/file-type/uuid from the production tree;
npm audit --omit=dev now reports 0 vulnerabilities. No runtime or build
impact.

Fixes #266

Author: sid88in