feat(wfe-yaml): add HTTP ops, module loader, and npm support via esm.sh

Phase 4 — Permission-gated HTTP fetch op:
- op_fetch with net permission check on every request
- globalThis.fetch() wrapper with .json()/.text() methods
- Supports GET/POST/PUT/DELETE with headers and body

Phase 5 — Module loader:
- WfeModuleLoader resolving npm: → esm.sh, https://, file://, relative paths
- All resolution paths permission-checked
- Bare path resolution (/) for esm.sh sub-module redirects
- Dynamic import rejection unless permissions.dynamic_import: true
- esm.sh auto-added to net allowlist when modules declared

Mandatory npm integration test (is-number via esm.sh).
25 new tests. 133 total deno tests, 326 total workspace tests.

Cargo.toml

@@ -49,6 +49,7 @@ regex = "1"
 
 # Deno runtime
 deno_core = "0.394"
+deno_error = "0.7"
 url = "2"
 
 # Dev/Test
@@ -56,3 +57,4 @@ pretty_assertions = "1"
 rstest = "0.23"
 wiremock = "0.6"
 tokio-stream = "0.1"
+tempfile = "3"