fix(ai-lakera-guard): streaming alert mode honors fail_open on Lakera errors

[janiussyafiq]

Description

Streaming action=alert discarded the response scan's deny result, so a Lakera error/timeout with fail_open=false leaked the streamed response instead of failing closed — contradicting the action contract that "Lakera API errors/timeouts stay governed by fail_open even in alert mode".

Alert mode now buffers the stream when fail_open=false so a Lakera error/timeout fails closed, while a flagged verdict is still released and only logged (shadow-mode semantics unchanged). With fail_open=true, alert keeps streaming live since nothing can block. Non-streaming and block paths are unchanged.

Which issue(s) this PR fixes:

Fixes #13619

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[membphis]

Code review looks good to me. Please make sure CI is green before merging.