Fix webhooks broken by the Backbone/underscore removal

[itisAliRH]

Tool and workflow webhooks stopped rendering anything after Backbone and underscore were removed from the client in #22357 and #22355. The former explicitly removed "the global window.Backbone exposure from libs.js".

Webhook script.js files are injected into the page as-is and run in the global scope, so they can only use globals the client still exposes. Both example plugins were written against Backbone.View.extend and _.template, so they now throw immediately and their container renders empty:

ReferenceError: Backbone is not defined

jQuery is still assigned to window.$/window.jQuery (client/src/entry/libs.js), which is why $-only webhooks such as gtn kept working and the breakage looks selective rather than total.

What this PR does

• Ports the phdcomics and xkcd example webhooks to self-contained vanilla JS (plain DOM APIs + fetch). Element ids are unchanged, so the existing styles.css still applies.
• Adds an xkcd server-side helper (__init__.py). The old script called http://dynamic.xkcd.com/api-0/jsonp/comic directly from the browser; that endpoint now redirects to HTTPS and the xkcd JSON API sends no CORS headers, so the call is blocked as mixed content on any HTTPS Galaxy. Fetching server-side matches what phdcomics already does. The helper also skips comic 404, which intentionally does not exist and returns HTTP 404, and bounds both requests with a timeout.
• Fixes a mount race in Webhook.vue: appendScriptStyle() ran synchronously right after setting webhookId, so the injected script executed before Vue had flushed the v-if div and could not find its own #<webhookId> mount point. The old scripts happened to mask this by deferring their body through $(document).ready; vanilla scripts run immediately, so the script is now injected after nextTick().
• Adds a regression test asserting that no served webhook script references the removed globals.
• Documents in webhooks.rst that webhook scripts must be self-contained vanilla JS.

Not included

config/plugins/webhooks/demo/search/script.js (the searchover overlay) is also Backbone-based and still broken. It is ~49 KB of bundled view code and is activate: false by default, so porting it is left to a follow-up rather than bundling it here.

Webhooks maintained outside this repository (for example usegalaxy.eu's citation_needed and iframe) are affected by the same root cause and need the equivalent change in their own repositories.

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. Start Galaxy with webhooks_dir: test/functional/webhooks in galaxy.yml.
  2. Run any tool and land on the tool success page.
  3. The phdcomics or xkcd panel should render a comic with a working "Random" button, and the browser console should be free of ReferenceError messages.

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.