feat(approvals) RejectConfig for request_permissions (#14118)

## Summary
We need to support allowing request_permissions calls when using
`Reject` policy

<img width="1133" height="588" alt="Screenshot 2026-03-09 at 12 06
40 PM"
src="https://github.com/user-attachments/assets/a8df987f-c225-4866-b8ab-5590960daec5"
/>

Note that this is a backwards-incompatible change for Reject policy. I'm
not sure if we need to add a default based on our current use/setup

## Testing
- [x] Added tests
- [x] Tested locally

codex-rs/core/tests/suite/skill_approval.rs

@@ -288,6 +288,7 @@ async fn shell_zsh_fork_skill_script_reject_policy_with_sandbox_approval_false_s
     let approval_policy = AskForApproval::Reject(RejectConfig {
         sandbox_approval: false,
         rules: true,
+        request_permissions: false,
         mcp_elicitations: false,
     });
     let server = start_mock_server().await;
@@ -380,6 +381,7 @@ async fn shell_zsh_fork_skill_script_reject_policy_with_sandbox_approval_true_sk
     let approval_policy = AskForApproval::Reject(RejectConfig {
         sandbox_approval: true,
         rules: false,
+        request_permissions: false,
         mcp_elicitations: false,
     });
     let server = start_mock_server().await;