feat: scaffold @metamask/snap-networks-utils (WPN-1632)

[ulissesferreira]

Summary

• Scaffold empty @metamask/snap-networks-utils via yarn create-package so MONO-2 extraction tickets can land as move+import changes
• Wire package into root tsconfigs, lockfile, and README; assign Networks CODEOWNERS
• Align template Jest/TypeScript deps with the monorepo; no snap consumers yet

Test plan

• yarn workspace @metamask/snap-networks-utils run build
• yarn workspace @metamask/snap-networks-utils run test
• yarn constraints
• Confirm no snap package.json depends on @metamask/snap-networks-utils

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​typedoc-plugin-missing-exports@​2.3.0
	npm/​@​ts-bridge/​cli@​0.6.4
	npm/​typedoc@​0.25.13

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• npm/shiki@0.14.7
• npm/vscode-oniguruma@1.7.0
• npm/cjs-module-lexer@1.4.3
• npm/marked@4.3.0

View full report

[ulissesferreira]

@SocketSecurity ignore npm/shiki@0.14.7
Transitive via typedoc (devDependency only, docs/build tooling).
"Obfuscated" alert is minified highlighter + TextMate grammars.
Network/fetch is for loading onig.wasm and local theme/grammar assets.
Same version already ignored in MetaMask/eth-json-rpc-middleware#426; also present in MetaMask/core via typedoc.

[ulissesferreira]

@SocketSecurity ignore npm/vscode-oniguruma@1.7.0
Transitive via typedoc → shiki (devDependency only).
fetch is Emscripten WASM bootstrap (same-origin).
Publisher change alexandrudima → vscode-bot is Microsoft maintainers on microsoft/vscode-oniguruma.
Same version ignored in MetaMask/eth-json-rpc-middleware#426; also in MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/cjs-module-lexer@1.4.3
Transitive via @ts-bridge/cli (build tooling only; not in published dist).
Official nodejs/cjs-module-lexer; installed sources use JSON.parse, not eval.
Already present in this repo via Jest as a different major.

[ulissesferreira]

@SocketSecurity ignore npm/marked@4.3.0
Transitive via typedoc (docs tooling only; not in published dist).
AI alert is about markdown URL sanitization; only used for typedoc HTML docs.
Same typedoc→marked@4.3.0 stack already in MetaMask/core.