Use the shared HTTP client in codex-protocol (#36033)

## What changed

- Replace direct `reqwest` error types in `codex-protocol` with
  `codex_http_client::HttpError`.
- Build the response-stream error test through
  `codex_http_client::HttpResponse`.
- Remove `codex-protocol` from the direct `reqwest` dependency allowlist.

## Testing

- Update the response-stream failure test to cover status and URL propagation
  through the shared HTTP response wrapper.

GitOrigin-RevId: 7abcbbe55f994acb13cccefef806a53c7008acde

codex-rs/deny.toml

@@ -243,7 +243,6 @@ deny = [
         "codex-core",
         "codex-ollama",
         "codex-otel",
-        "codex-protocol",
         "codex-responses-api-proxy",
         # Third-party crates that own their reqwest integration. These are not part of the
         # first-party migration count above.