fix($injector): allow a constructor function to return a function

This change makes `$injector.instantiate` (and thus `$provide.service`) to behave the same as native
`new` operator.