Support custom transports for Amazon Bedrock (#33695)

## What changed

- Allow the built-in `amazon-bedrock` provider to override `base_url`, `auth`,
  and `http_headers` in addition to its AWS profile and region.
- Use command-based bearer authentication and configured endpoints without
  applying AWS request signing, while retaining regional endpoint resolution
  for the default Bedrock configuration.
- Replace the Bedrock account `credentialSource` enum with the
  `usesCodexManagedCredentials` boolean so command-authenticated and other
  externally managed configurations are reported consistently.

## Testing

- Cover configuration merging and validation, command-authenticated proxy
  requests with custom headers, and account reporting for managed and external
  credentials.

GitOrigin-RevId: d1acbe602060470583b5e12f8d304bee5be46f4c

codex-rs/protocol/src/account.rs

@@ -39,18 +39,10 @@ pub enum ProviderAccount {
         plan_type: PlanType,
     },
     AmazonBedrock {
-        credential_source: AmazonBedrockCredentialSource,
+        uses_codex_managed_credentials: bool,
     },
 }
 
-#[derive(Serialize, Deserialize, Copy, Clone, Debug, PartialEq, Eq, JsonSchema, TS)]
-#[serde(rename_all = "camelCase")]
-#[ts(rename_all = "camelCase")]
-pub enum AmazonBedrockCredentialSource {
-    CodexManaged,
-    AwsManaged,
-}
-
 impl PlanType {
     pub fn is_team_like(self) -> bool {
         matches!(self, Self::Team | Self::SelfServeBusinessUsageBased)