Remove app-server's direct reqwest dependency (#39293)

## Why

`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.

## What changed

- Build app-server test HTTP clients through `HttpClientBuilder`.
- Use `http` and `url` types directly where only protocol types are needed.
- Remove `reqwest` from `codex-app-server` and its temporary dependency-policy
  exception.

GitOrigin-RevId: ff9f14a54bc20ec1ea39050bbe08c381ee376119

codex-rs/deny.toml

@@ -244,7 +244,6 @@ deny = [
         # upstream HTTP transport independently of Codex.
         "codex-responses-api-proxy",
         # Temporary migration exceptions.
-        "codex-app-server",
         "codex-otel",
         # Third-party crates that own their reqwest integration. These are not part of the
         # first-party migration count above.