Add dynamic HTTP header helpers for MCP servers (#38245)

## What changed

- Add `http_headers_helper` configuration for local streamable HTTP MCP servers. The configured shell command runs once per connection and returns a JSON object of headers that is cached across requests.
- Apply helper headers to MCP startup and OAuth flows while restricting them to the server origin, stopping redirects, rejecting reserved or duplicate headers, and enforcing output and execution limits.
- Reject helpers for remote or managed-disabled servers, use the local environment working directory, and redact helper commands from `codex mcp list` and `codex mcp get` output.

## Testing

- Cover configuration validation, helper lifecycle and output parsing, origin isolation, OAuth discovery and token refresh, managed requirements, environment selection, and CLI redaction.

GitOrigin-RevId: 84e0e26ce75520b0869d37c72b1678e033bd6818

codex-rs/codex-mcp/src/tool_catalog_cache.rs

@@ -235,7 +235,7 @@ impl ToolCatalogIdentity {
                 &config.transport,
                 McpServerTransportConfig::Stdio { cwd: None, .. }
             )
-            .then(|| runtime_context.local_stdio_fallback_cwd()),
+            .then(|| runtime_context.local_process_cwd()),
         })
     }
 }
@@ -258,8 +258,13 @@ impl ToolCatalogTransportIdentity {
             bearer_token_env_var,
             http_headers,
             env_http_headers,
+            http_headers_helper,
         } = &config.transport
         {
+            // Helper output is a dynamic credential identity that cannot be represented by config.
+            if http_headers_helper.is_some() {
+                return None;
+            }
             let (connection_identity, protocol_mode, agent_plugin) = connection_identity?;
             if config.oauth.is_some()
                 || config.scopes.is_some()