[RFC] Add WebAssembly (Proxy-WASM) Dynamic Filter Subsystem (pingora-wasm)

### Summary
My propose introducing an opt-in WebAssembly filter runtime crate (`pingora-wasm`) to enable dynamic, hot-loadable proxy extensions for Pingora without needing to recompile or restart proxy binaries.

### Motivation
Proxies in modern cloud-native environments (e.g., Envoy) rely heavily on WebAssembly (Proxy-WASM) for dynamic security, auth, and header-mutation plugins. Providing native Wasm host support in Pingora will:
1. Allow developers to write proxy filters in Rust, Go, C++, or Zig and deploy them on the fly.
2. Maintain Pingora's high-performance characteristics using a sandboxed `wasmtime` JIT engine.
3. Bring enterprise-grade dynamic plugin extensibility to the Pingora ecosystem.

### Proposed Architecture
- **Crate**: `pingora-wasm` (workspace module under `pingora/`)
- **Runtime Engine**: `wasmtime` (JIT-compiled Wasm engine)
- **Interface**: Binds Pingora's `ProxyHttp` lifecycle callbacks (`request_filter`, `response_filter`) to Wasm guest modules via standard Proxy-WASM ABI host functions.

### Prototype Status
I have built an initial prototype crate (`pingora-wasm`) compiled and verified against Pingora's current workspace.

I would love to gather feedback from Cloudflare maintainers regarding:
1. Preferred module location (`pingora-wasm` crate vs optional feature flag under `pingora-proxy`).
2. Any specific ABI or runtime constraints preferred by the team.

Looking forward to your thoughts and guidance before opening the Pull Request!

Review the proposed pingora-wasm workspace crate and the pingora-proxy ProxyHttp lifecycle callbacks, especially request_filter and response_filter. Compare the two proposed module locations, then investigate the Proxy-WASM ABI and wasmtime constraints mentioned in the RFC. This issue is complete when maintainers have given direction on the crate or feature design and the required runtime constraints.

Written by the indexing model from the issue text.