Use configured HTTP clients for all MCP OAuth requests (#35814)

## What changed

- Require callers to provide an HTTP client for MCP OAuth discovery and login, removing the separate direct `reqwest` path.
- Use the shared `http` and `url` types throughout the MCP client and drop its direct `reqwest` dependency.
- Preserve configured MCP headers when routing OAuth discovery through the provided client.

## Testing

- Add coverage that routed OAuth discovery forwards configured headers.

GitOrigin-RevId: 1345f56bd794626533133447597a5908e57b9b48

codex-rs/deny.toml

@@ -245,7 +245,6 @@ deny = [
         "codex-otel",
         "codex-protocol",
         "codex-responses-api-proxy",
-        "codex-rmcp-client",
         "codex-tui",
         # Third-party crates that own their reqwest integration. These are not part of the
         # first-party migration count above.