🤖 avm2: Send Shockwave-Flash-branded User-Agent from URLRequest (#9395)

[MavenRain]

Description

Addresses the User-Agent piece of #9395.

Flash Player sent a Shockwave-Flash-branded User-Agent on
URLLoader/Loader/URLStream fetches. Ruffle currently sends Ruffle/
(https://ruffle.rs) (the default reqwest client-level User-Agent on desktop,
set at frontend-utils/src/backends/navigator.rs:86), or the browser's
User-Agent on the web build. Flash-aware services that filter or branch on
User-Agent see "Ruffle" today and treat the request as non-Flash.

The fix mirrors the recently-landed X-Flash-Version pattern:
request_from_url_request in flash.display.Loader inserts a User-Agent entry
into string_headers before the user-headers loop, so the per-request header
overrides the reqwest client default while still letting
URLRequest.requestHeaders win for users who supply their own.

User-Agent value

Mozilla/5.0 (compatible; Shockwave Flash {player_version}.0.0.0)

For example, with player_version = 32: Mozilla/5.0 (compatible; Shockwave
Flash 32.0.0.0).

I picked a clearly-Flash-branded string rather than the IE-spoofing UA real
Flash Player 32 sent (Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0;
rv:11.0) like Gecko) because:

1. The IE-spoofing form is OS-specific (different strings on Win/Mac/Linux)
   and ties us to the IE 11 UA's expiry date.
2. "Shockwave Flash" is the recognized brand for Flash-aware UA filtering
   historically.
3. Reviewers can ask for the IE-spoofing variant in follow-up if compatibility
   with a specific service requires it.

Web-platform caveat

fetch() in modern browsers silently drops user-supplied User-Agent headers per
security restrictions, so this fix only takes effect on the desktop build.
On the web build the browser's own UA flows through unchanged.

Test updates

tests/tests/swfs/avm2/loader_load/output.txt and
tests/tests/swfs/avm2/loader_method/output.txt updated to include the new
User-Agent: Mozilla/5.0 (compatible; Shockwave Flash 32.0.0.0) line in the
captured fetch headers. These were the only log_fetch=true fixtures whose
output.txt exercised a URLRequest path.

Remaining #9395 scope

Content-Type was implicitly fixed when URLRequest.contentType was wired up
after the 2023 report (both backends transmit it via body.1 mime-type today).
Accept and Accept-Encoding remain unimplemented and would be separate
follow-up PRs.

• cargo test --package tests (url_, netconnection_, loader_*: all green, 59
  tests)