fix: derive Trolley-Source header from package.json version

[barnett]

Summary

The SDK was sending a hardcoded Trolley-Source header (javascript-sdk_1.1.0) even though package.json is at 1.2.0. This PR reads the version from package.json at runtime so the header stays in sync with releases.

Changes

SDK

• lib/Client.ts: Replace hardcoded CURRENT_CLIENT_VERSION = "1.1.0" with require("../package.json").version
• Trolley-Source header is now built as javascript-sdk_${packageVersion} automatically on each release

Tests

• Add unit test in test/unit/releasePrepSpec.ts that asserts outgoing requests include the correct Trolley-Source header matching package.json

CI (Codecov)

• Bump Codecov orb from 5.0.3 → 5.4.3
• Install Codecov CLI via PyPI before upload and point the orb at the installed binary