Let extensions resolve approval reviews before Guardian (#38592)

## What changed

- Give approval review contributors the first opportunity to resolve an action when automatic review is not required for the model.
- Return an extension's decision directly and fall back to Guardian when no extension claims the review.
- Update Guardian V2 to approve actions below its risk threshold through the review contributor API, and remove the extension approval-policy API.

## Testing

- Verify that an extension approval bypasses both the Guardian model call and the user approval prompt.
- Cover Guardian V2 review decisions for low-risk, high-risk, and disabled threads.

GitOrigin-RevId: 5be56941143aff6f358b75b5f8101b7c047147ae

codex-rs/core/src/mcp_tool_call.rs

@@ -1306,7 +1306,7 @@ async fn maybe_request_mcp_tool_approval(
     let strict_auto_review = match turn_state {
         Some(turn_state) => turn_state.lock().await.strict_auto_review_enabled(),
         None => false,
-    } || sess.extension_strict_auto_review_enabled().await;
+    };
     let approvals_reviewer = connectors::mcp_approvals_reviewer_from_layers(
         &config.config_layer_stack,
         config.approvals_reviewer,