Remove app-server's direct reqwest dependency (#39293)

## Why

`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.

## What changed

- Build app-server test HTTP clients through `HttpClientBuilder`.
- Use `http` and `url` types directly where only protocol types are needed.
- Remove `reqwest` from `codex-app-server` and its temporary dependency-policy
  exception.

GitOrigin-RevId: ff9f14a54bc20ec1ea39050bbe08c381ee376119

codex-rs/app-server/Cargo.toml

@@ -129,10 +129,10 @@ codex-utils-cargo-bin = { workspace = true }
 core_test_support = { workspace = true }
 flate2 = { workspace = true }
 hmac = { workspace = true }
+http = { workspace = true }
 opentelemetry = { workspace = true }
 opentelemetry_sdk = { workspace = true }
 pretty_assertions = { workspace = true }
-reqwest = { workspace = true, features = ["rustls-tls"] }
 rmcp = { workspace = true, default-features = false, features = [
     "elicitation",
     "server",