feat(core): persist network approvals in execpolicy (#12357)

## Summary
Persist network approval allow/deny decisions as `network_rule(...)`
entries in execpolicy (not proxy config)

It adds `network_rule` parsing + append support in `codex-execpolicy`,
including `decision="prompt"` (parse-only; not compiled into proxy
allow/deny lists)
- compile execpolicy network rules into proxy allow/deny lists and
update the live proxy state on approval
- preserve requirements execpolicy `network_rule(...)` entries when
merging with file-based execpolicy
- reject broad wildcard hosts (for example `*`) for persisted
`network_rule(...)`

codex-rs/mcp-server/src/codex_tool_runner.rs

@@ -223,6 +223,7 @@ async fn run_codex_tool_session_inner(
                             approval_id: _,
                             reason: _,
                             proposed_execpolicy_amendment: _,
+                            proposed_network_policy_amendments: _,
                             parsed_cmd,
                             network_approval_context: _,
                         } = ev;