Record result sources in app tool analytics (#42164)

## What changed

- Add per-tool `analytics_result_source` requirements, with support for the
  `detailed_message_search_v1` format and normal configuration precedence.
- Attach host-generated source IDs from accepted app tool results to recorded
  executed tool calls for both direct and Code Mode invocations.
- Bound and deduplicate source metadata, reject caller-supplied values, and
  shed optional source data before dropping tool-call or completion metadata.
- Preserve source updates across waits and retries while preventing stale or
  compacted records from overwriting accepted metadata.

## Testing

Add coverage for requirement parsing and merging, trusted source snapshots,
metadata budgets, retries, waits, and compaction.

GitOrigin-RevId: 7d5e394219eb33e0ab7b6db3f039138a78569d17

codex-rs/connectors/src/app_tool_policy_tests.rs

@@ -53,6 +53,7 @@ fn evaluator_reuses_one_snapshot_across_tools() {
                         "events/create".to_string(),
                         AppToolRequirementToml {
                             approval_mode: Some(AppToolApproval::Approve),
+                            ..Default::default()
                         },
                     )]),
                 }),
@@ -937,6 +938,7 @@ fn app_tool_requirements(
                         tool_name.to_string(),
                         AppToolRequirementToml {
                             approval_mode: Some(approval_mode),
+                            ..Default::default()
                         },
                     )]),
                 }),