feat(core): plumb distinct approval ids for command approvals (#12051)

zsh fork PR stack:
- https://github.com/openai/codex/pull/12051 👈 
- https://github.com/openai/codex/pull/12052

With upcoming support for a fork of zsh that allows us to intercept
`execve` and run execpolicy checks for each subcommand as part of a
`CommandExecution`, it will be possible for there to be multiple
approval requests for a shell command like `/path/to/zsh -lc 'git status
&& rg \"TODO\" src && make test'`.

To support that, this PR introduces a new `approval_id` field across
core, protocol, and app-server so that we can associate approvals
properly for subcommands.

codex-rs/app-server-test-client/src/lib.rs

@@ -1302,6 +1302,7 @@ impl CodexClient {
             thread_id,
             turn_id,
             item_id,
+            approval_id,
             reason,
             command,
             cwd,
@@ -1310,7 +1311,8 @@ impl CodexClient {
         } = params;
 
         println!(
-            "\n< commandExecution approval requested for thread {thread_id}, turn {turn_id}, item {item_id}"
+            "\n< commandExecution approval requested for thread {thread_id}, turn {turn_id}, item {item_id}, approval {}",
+            approval_id.as_deref().unwrap_or("<none>")
         );
         if let Some(reason) = reason.as_deref() {
             println!("< reason: {reason}");