[POP-3811] support World ID walletkit user agents

[Guardiola31337]

Description

• Follow-up from Slack thread: https://tfh.slack.com/archives/C0520KUC44X/p1779960456778019?thread_ts=1779855740.827129&cid=C0520KUC44X
• Mirrors the approach from https://github.com/worldcoin/oxide/pull/1050: android-id / ios-id clients should produce WorldID user agents, while existing World App clients stay on WorldApp.
• Adds the Kotlin/Swift-accessible header value API needed for downstream apps to consume the WalletKit builder directly.
• Scope note: WalletKit can now build the correct header for downstream and WalletKit-owned clients, but Authenticator.init_with_defaults / register_with_defaults still cannot inject it into internal world-id-core indexer/gateway requests until world-id-core exposes a user-agent/client hook.

Changes

• Map android-id / ios-id client names to the WorldID user-agent product.
• Keep all other client names mapped to WorldApp.
• Add UserAgentBuilder helpers for app product selection and client-name/os-version suffixes.
• Expose UserAgent.header_value() for FFI consumers so Android/iOS can pass the exact built header value.
• Add user-agent coverage for World App and World ID Android/iOS formats, plus FFI header value access.

Downstream validation

• Published org.world:walletkit:0.19.1-SNAPSHOT locally and integrated it in wld-android.
• Added Android instrumentation coverage confirming:
  • World App client android -> WorldApp/<app-version> walletkit-core/<version> android/<os-version>
  • World ID App client android-id -> WorldID/<app-version> walletkit-core/<version> android-id/<os-version>
• Built, installed, and launched both .dev Android apps successfully on a connected Pixel 3 / Android 12 device.

Testing Instructions

• cargo fmt --check
• cargo test -p walletkit-core user_agent --lib
• cargo clippy -p walletkit-core --lib --tests -- -D warnings
• RUSTUP_HOME=~/.rustup CARGO_HOME=~/.cargo ./kotlin/local_kotlin.sh 0.19.1-SNAPSHOT
• Downstream Android: ./gradlew :walletKit:impl:connectedDebugAndroidTest -Pandroid.testInstrumentationRunnerArguments.class=com.world.walletkit.impl.WalletKitUserAgentInstrumentedTest
• Downstream Android: ./gradlew :app:assembleDevDebug :worldIdApp:assembleDevDebug :app:installDevDebug :worldIdApp:installDevDebug

[Guardiola31337]

Question for reviewers:

This PR now mirrors the oxide user-agent product mapping (android-id / ios-id -> WorldID, existing android / ios -> WorldApp) and exposes the built header value for FFI consumers so downstream apps can pass it to WalletKit-owned / app-owned HTTP paths.

During downstream Android integration, I noticed one remaining coverage question: WalletKit's init_with_defaults / register_with_defaults wrappers eventually call into world-id-core / world-id-authenticator, and that dependency currently creates its own reqwest::Client internally for indexer/gateway requests. There does not appear to be a user-agent/client hook WalletKit can pass through for those internal requests yet.

Do we want to keep this PR scoped to the WalletKit builder + FFI surface and follow up in world-id-core with a user-agent injection hook, then wire WalletKit defaults through it? Or should this PR be blocked until the world-id-core path can be covered too?

My lean is to keep this PR scoped and track the world-id-core hook as follow-up, because the hook belongs in that dependency boundary, but I want to make sure reviewers agree with that split.