feat(functions): expose HTTP-mode metadata and webhook invocation

Follow-up to Kong/volcano-hosting#908.

Update the JavaScript SDK for function HTTP mode:

• expose invocation_mode, http_auth_mode, and nullable openapi_spec on function types
• preserve existing RPC invoke behavior
• add a raw HTTP-mode helper, or document direct fetch(invoke_url + path), without wrapping the body in {payload}
• do not attach Volcano credentials when a caller explicitly selects unauthenticated webhook access
• preserve repeated response headers where the runtime permits
• add contract tests for authenticated HTTP mode and public http_auth_mode=none
• document that webhook signatures must be verified by function code

Start by locating the JavaScript SDK's function type definitions and existing RPC invocation path, then trace how invoke_url and Volcano credentials are handled. Add HTTP-mode metadata and invocation behavior without changing RPC calls, and cover authenticated HTTP mode plus public http_auth_mode=none in contract tests. Update the documentation to explain direct webhook access and signature verification.