Add request permissions tool (#13092)

Adds a built-in `request_permissions` tool and wires it through the
Codex core, protocol, and app-server layers so a running turn can ask
the client for additional permissions instead of relying on a static
session policy.

The new flow emits a `RequestPermissions` event from core, tracks the
pending request by call ID, forwards it through app-server v2 as an
`item/permissions/requestApproval` request, and resumes the tool call
once the client returns an approved subset of the requested permission
profile.

codex-rs/core/config.schema.json

@@ -410,6 +410,9 @@
             "request_permissions": {
               "type": "boolean"
             },
+            "request_permissions_tool": {
+              "type": "boolean"
+            },
             "request_rule": {
               "type": "boolean"
             },
@@ -1882,6 +1885,9 @@
         "request_permissions": {
           "type": "boolean"
         },
+        "request_permissions_tool": {
+          "type": "boolean"
+        },
         "request_rule": {
           "type": "boolean"
         },