Refactor network approvals to host/protocol/port scope (#12140)

## Summary
Simplify network approvals by removing per-attempt proxy correlation and
moving to session-level approval dedupe keyed by (host, protocol, port).
Instead of encoding attempt IDs into proxy credentials/URLs, we now
treat approvals as a destination policy decision.

- Concurrent calls to the same destination share one approval prompt.
- Different destinations (or same host on different ports) get separate
prompts.
- Allow once approves the current queued request group only.
- Allow for session caches that (host, protocol, port) and auto-allows
future matching requests.
- Never policy continues to deny without prompting.

Example:
- 3 calls: 
  - a.com (line 443)
  - b.com (line 443)
  - a.com (line 443)
=> 2 prompts total (a, b), second a waits on the first decision.
- a.com:80 is treated separately from a.com line 443

## Testing
- `just fmt` (in `codex-rs`)
- `cargo test -p codex-core tools::network_approval::tests`
- `cargo test -p codex-core` (unit tests pass; existing
integration-suite failures remain in this environment)

codex-rs/app-server-test-client/src/lib.rs

@@ -1491,6 +1491,7 @@ impl CodexClient {
             item_id,
             approval_id,
             reason,
+            network_approval_context,
             command,
             cwd,
             command_actions,
@@ -1506,6 +1507,9 @@ impl CodexClient {
         if let Some(reason) = reason.as_deref() {
             println!("< reason: {reason}");
         }
+        if let Some(network_approval_context) = network_approval_context.as_ref() {
+            println!("< network approval context: {network_approval_context:?}");
+        }
         if let Some(command) = command.as_deref() {
             println!("< command: {command}");
         }