Use configured HTTP clients for all MCP OAuth requests (#35814)

## What changed

- Require callers to provide an HTTP client for MCP OAuth discovery and login, removing the separate direct `reqwest` path.
- Use the shared `http` and `url` types throughout the MCP client and drop its direct `reqwest` dependency.
- Preserve configured MCP headers when routing OAuth discovery through the provided client.

## Testing

- Add coverage that routed OAuth discovery forwards configured headers.

GitOrigin-RevId: 1345f56bd794626533133447597a5908e57b9b48

codex-rs/rmcp-client/Cargo.toml

@@ -27,14 +27,10 @@ codex-utils-pty = { workspace = true }
 codex-utils-home-dir = { workspace = true }
 bytes = { workspace = true }
 futures = { workspace = true, default-features = false, features = ["std"] }
+http = { workspace = true }
 keyring = { workspace = true, features = ["crypto-rust"] }
 memchr = { workspace = true }
 oauth2 = "5"
-reqwest = { version = "0.13", default-features = false, features = [
-    "json",
-    "stream",
-    "rustls",
-] }
 rmcp = { workspace = true, default-features = false, features = [
     "auth",
     "base64",
@@ -44,7 +40,7 @@ rmcp = { workspace = true, default-features = false, features = [
     "server",
     "transport-async-rw",
     "transport-child-process",
-    "transport-streamable-http-client-reqwest",
+    "transport-streamable-http-client",
     "transport-streamable-http-server",
 ] }
 serde = { workspace = true, features = ["derive"] }
@@ -63,11 +59,13 @@ tokio = { workspace = true, features = [
     "time",
 ] }
 tracing = { workspace = true, features = ["log"] }
+url = { workspace = true }
 urlencoding = { workspace = true }
 webbrowser = { workspace = true }
 which = { workspace = true }
 
 [dev-dependencies]
+codex-http-client = { workspace = true }
 codex-utils-cargo-bin = { workspace = true }
 pretty_assertions = { workspace = true }
 serial_test = { workspace = true }