Request download_mode=direct for direct artifact downloads

What does this MR do?

When FF_USE_DIRECT_DOWNLOAD requests direct_download=true, also send the new download_mode=direct query parameter on job artifact downloads, so administrators can allow runners to bypass proxy_download even when it's enabled globally, via allowed_download_modes.

Why was this MR needed?

Self-managed instances with proxy_download: true (air-gapped/private-network setups) currently force all artifact downloads through Workhorse, even for runners with direct object storage access. direct_download is an existing, distinct runner capability flag; the new download_mode parameter is the separate, admin-controlled override this depends on.

What's the best way to test this MR?

go test ./network/... covers the new download_mode behavior (TestArtifactsDownload) alongside the existing artifact download suite.

What are the relevant issue numbers?

Related to gitlab#624081 (closed) Companion chart MR: gitlab-org/charts/gitlab!5313 (merged) Companion Omnibus MR: omnibus-gitlab!9749 (merged)

Depends on gitlab!252350 (merged) Depends on gitlab!257219 (merged)

Companion server MR: gitlab!257219 (merged) This runner MR depends on the server change above.