Fix Moodle-native MCP transport and plugin CI

[gafapa]

What changed

• replaces direct native cURL calls in the MCP-to-REST bridge with Moodle's core\http_client
• preserves transport timeouts, non-throwing HTTP status handling, JSON validation, and canonical errors
• adds a regression test preventing direct curl_* transport calls
• fixes the invalid job-level runner.temp expression in the existing workflow
• adds Moodle Plugin CI coverage for Moodle 5.2 on PostgreSQL and MariaDB, including PHP lint, plugin validation, savepoint checks, and PHPUnit

Why

The native cURL call bypassed Moodle proxy and request-security handling. The existing workflow also failed before creating jobs because the runner context is unavailable in job-level environment expressions.

The plugin still has broad pre-existing Moodle Code Checker and PHPDoc debt, so those two optional checks are not used as merge gates in this focused fix. Runtime and structural checks remain mandatory.

Validation

• npm ci
• npm run release:check (70 static tests)
• actionlint .github/workflows/ci.yml .github/workflows/moodle-plugin-ci.yml
• plugin package generation

Closes #1
Closes #3