fix: remove config from expression scope

[AAtomical]

Summary

config() is currently registered in math.expression.mathWithTransform, making it callable from math.evaluate() expressions. This allows an expression to mutate the shared configInternal singleton (e.g., relTol, absTol), corrupting comparison results (equal, compare, larger, smaller) for all subsequent evaluations on the same instance.

The function is not listed in the security documentation's recommended blocklist (docs/expressions/security.md), so applications following the official hardening guide remain vulnerable.

This patch removes config from mathWithTransform so it is no longer accessible from expressions. math.config() from JavaScript continues to work as before.

Reproduction

const math = create(all)
const limitedEvaluate = math.evaluate

// Apply official hardening
math.import({
  'import': function () { throw new Error('disabled') },
  'createUnit': function () { throw new Error('disabled') },
  // ... all documented overrides
}, { override: true })

limitedEvaluate('equal(1, 99)')           // false (correct)
limitedEvaluate('config({"relTol": 1000})')
limitedEvaluate('equal(1, 99)')           // true  (corrupted)

Test plan

• Verify math.evaluate('config()') throws "Undefined function config"
• Verify math.config() from JS still works
• Verify equal, compare, larger, smaller are not affected
• Verify existing test suite passes