feat(scripting-methods): Bru scripting methods

[sachin-bruno]

Problem:
The docs playground runs pre-request, post-response, and test scripts in a browser-based QuickJS sandbox, but it had no bru object. Any script using bru.* (variables, environment values, interpolation, sendRequest, and so on) either threw or silently did nothing, so the same script behaved differently in the docs than in the Bruno desktop app.

Solution:
This PR implements the full bru scripting object on top of the sandbox, matching Bruno's behavior for everything a browser can support: runtime, environment, collection, folder, request, and secret variables, plus interpolate, sendRequest, sleep, getTestResults, and getAssertionResults. Anything that genuinely cannot run in a browser docs context is stubbed to push a single de-duplicated warning that points the user to the desktop app, instead of failing silently.

[vasharma05-bruno]

Some findings from Claude that might be helpful:

Correctness
bru.getEnvName() always returns undefined. bru.ts:222 reads environmentVariables.__name__, but nothing in the runner ever sets __name__ — getEnvironmentVariables builds the store only from environment.variables. The three sites that protect name (deleteEnvVar, getAllEnvVars, deleteAllEnvVars) show it was meant to hold the env name, but it's never populated. This is a supported (non-stubbed) API silently returning nothing. Populate name from the active environment when building the store.

bru.runRequest swallows its own errors. In the shim, shims/bru.ts runRequest's .catch does promise.resolve({ message }) instead of promise.reject. So the deliberate errors thrown by makeNestedRunRequest (invalid path, non-http target, circular reference, max-depth) never surface as thrown exceptions — a script await bru.runRequest('bad/path') gets a resolved object, not a throw. sendRequest right above it correctly rejects; make the two consistent.

Security (risk to be aware of, feature-inherent)
bru.sendRequest is an unrestricted browser fetch to a fully script-controlled URL/method/headers/body (bru.ts sendRequest). Combined with the now-functional getSecretVar/getEnvVar/interpolate, a script in an untrusted published collection can read viewer-entered secret/env values and POST them to an arbitrary host. It's CORS-limited and sets no credentials (no ambient-cookie CSRF), and this mirrors Bruno-desktop behavior — but the docs playground's trust model is different (a viewer running someone else's collection). Worth a conscious decision: a scheme/host note in docs, or leave as-is by design.

Can you see how this is implemented in the Bruno App ☝️