Broker credential aliases in child environments (#40484)

## What changed

- Discover supported credentials inherited from the parent even when their canonical provider variable is filtered from the child environment.
- Replace matching values and credentials embedded in longer child environment values with broker dummies, then restore only aliases that the broker virtualized.
- Preserve provider and host bindings when selecting credentials for outbound requests, including GitHub Enterprise and custom OpenAI hosts.
- Expose helpers for identifying provider and binding variables, plus an API for virtualizing credential-bearing text before it is persisted.

## Testing

- Extend credential broker tests for filtered parent variables, exact and embedded aliases, text virtualization, user overrides, and host-bound GitHub and OpenAI credentials.

GitOrigin-RevId: 55d673911900470aab4e206d0f4f5e62ed3611ae

codex-rs/network-proxy/src/credential_broker/providers/github.rs

@@ -24,10 +24,12 @@ pub(super) static PROVIDER: CredentialProvider = CredentialProvider {
     sources: &[
         CredentialSource {
             env_vars: GITHUB_CLOUD_TOKEN_ENV_VARS,
+            binding_env_vars: &[],
             host_binding: github_cloud_binding,
         },
         CredentialSource {
             env_vars: GITHUB_ENTERPRISE_TOKEN_ENV_VARS,
+            binding_env_vars: &[GH_HOST_ENV_VAR],
             host_binding: github_enterprise_binding,
         },
     ],