Investigate use of `sinon` and replace with `tinyspy` where appropriate

[gameroman]

See #247

Only replace where appropriate. e.g. repos which already use vitest should use the built in spy rather than sinon, see es-tooling/module-replacements#247 (comment)

dependents

dev dependents