Make device classification pluggable with a no-host-call default #780

User story

As a deployer, I want device classification to be a selectable module whose default makes no host-specific call, so that the default path privileges no host and I can opt into a stronger signal where my host provides one.

Description

Introduce a DeviceModule interface that produces the coarse browser and bot classification the Edge Cookie gate uses. The default module is User-Agent only and makes no host-specific call. Add an opt-in module, fastly, that strengthens the classification with the JA4 (TLS) and HTTP/2 probabilistic identifiers the host exposes, gathered only when that module is selected. These signals serve identifier gating and bot detection, not bid enrichment, and a richer device model for the ad request is a separate concern.

Done when

• A DeviceModule interface is selected by [device] module.
• The default is User-Agent only and makes no host-specific call.
• An opt-in module reads the host's JA4 and HTTP/2 probabilistic identifiers, gathered only when selected.
• The bot gate works on the User-Agent-only default.

References

• Part of Pluggable, competition-neutral modules with a technical permission model #777. Implemented by device and geo module selection (Add device and geo module selection with the host-signal Edge Cookie module #1044), with the host module at crates/device/fastly.
• Related: As publisher I want to use list of JA4 fingerprint ids to allow list for creating EC #710 (JA4 allow-list for creating EC).