Use configured HTTP clients for all MCP OAuth requests (#35814)

## What changed

- Require callers to provide an HTTP client for MCP OAuth discovery and login, removing the separate direct `reqwest` path.
- Use the shared `http` and `url` types throughout the MCP client and drop its direct `reqwest` dependency.
- Preserve configured MCP headers when routing OAuth discovery through the provided client.

## Testing

- Add coverage that routed OAuth discovery forwards configured headers.

GitOrigin-RevId: 1345f56bd794626533133447597a5908e57b9b48

codex-rs/app-server/src/request_processors/mcp_processor.rs

@@ -172,7 +172,7 @@ impl McpRequestProcessor {
             })?;
 
         let discovered_scopes = if scopes.is_none() && server.scopes.is_none() {
-            discover_supported_scopes_with_http_client(
+            discover_supported_scopes(
                 &server.transport,
                 Arc::clone(&http_client),
                 codex_rmcp_client::OAuthDiscoveryTimeout::Requested,
@@ -184,7 +184,7 @@ impl McpRequestProcessor {
         let resolved_scopes =
             resolve_oauth_scopes(scopes, server.scopes.clone(), discovered_scopes);
 
-        let handle = perform_oauth_login_return_url_with_http_client(
+        let handle = perform_oauth_login_return_url(
             &name,
             &url,
             mcp_config.mcp_oauth_credentials_store_mode,