feat(core): add network constraints schema to requirements.toml (#10958)

## Summary

Add `requirements.toml` schema support for admin-defined network
constraints in the requirements layer

example config:

```
[experimental_network]
enabled = true
allowed_domains = ["api.openai.com"]
denied_domains = ["example.com"]
```

codex-rs/cloud-requirements/src/lib.rs

@@ -385,6 +385,7 @@ mod tests {
                 mcp_servers: None,
                 rules: None,
                 enforce_residency: None,
+                network: None,
             })
         );
     }
@@ -426,6 +427,7 @@ mod tests {
                 mcp_servers: None,
                 rules: None,
                 enforce_residency: None,
+                network: None,
             })
         );
     }
@@ -470,6 +472,7 @@ mod tests {
                 mcp_servers: None,
                 rules: None,
                 enforce_residency: None,
+                network: None,
             })
         );
         assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);