refactor(memoize): depend on harden, not ses (#3107)

Closes: #XXXX
Refs: #3108

## Description

`@endo/memoize` is a tiny package that had depended on `'ses'` only for
`harden`. It is a great example of why we factored `harden` out into an
importable `@endo/harden`. The PR changes `@endo/memoize` to depend
directly on `endo@harden` rather than `ses`.

### Security Considerations

@endo/harden enables non-protecting hardens, but only when protection is
off in general. @endo/memoize only provides its strong guarantees when
@endo/harden is fully protecting. This is all consistent, so I would
say:

No weakening of security.

### Scaling Considerations

A bit. It means other packages can depend on @endo/memoize without
bringing in all of ses.

### Documentation Considerations

none

### Testing Considerations

- [x] Should do the multi-ses-ava mode testing that @kriskowal set up.
Addendum: happy to find that it already happens without my needing to do
anything. Thanks @kriskowal !

### Compatibility Considerations

none

### Upgrade Considerations

none

Author: erights

.changeset/thin-toes-mix.md

@@ -0,0 +1,5 @@
+---
+'@endo/memoize': patch
+---
+
+`@endo/memoize` no longer depends on `ses`, just `@endo/harden`

packages/memoize/index.js

@@ -1,3 +1 @@
-/// <reference types="ses"/>
-
 export * from './src/memoize.js';

packages/memoize/package.json

@@ -35,8 +35,7 @@
     "test:c8": "c8 ${C8_OPTIONS:-} ses-ava"
   },
   "dependencies": {
-    "@endo/harden": "workspace:^",
-    "ses": "workspace:^"
+    "@endo/harden": "workspace:^"
   },
   "devDependencies": {
     "@endo/init": "workspace:^",

yarn.lock

@@ -903,7 +903,6 @@ __metadata:
     ava: "catalog:dev"
     c8: "catalog:dev"
     eslint: "catalog:dev"
-    ses: "workspace:^"
     typescript: "npm:~5.9.2"
   languageName: unknown
   linkType: soft