feat(core): add network constraints schema to requirements.toml (#10958)

## Summary

Add `requirements.toml` schema support for admin-defined network
constraints in the requirements layer

example config:

```
[experimental_network]
enabled = true
allowed_domains = ["api.openai.com"]
denied_domains = ["example.com"]
```

codex-rs/core/src/config/mod.rs

@@ -1653,6 +1653,7 @@ impl Config {
             mcp_servers,
             exec_policy: _,
             enforce_residency,
+            network: _network_requirements,
         } = requirements;
 
         apply_requirement_constrained_value(
@@ -4379,6 +4380,7 @@ model_verbosity = "high"
             mcp_servers: None,
             rules: None,
             enforce_residency: None,
+            network: None,
         };
         let requirement_source = crate::config_loader::RequirementSource::Unknown;
         let requirement_source_for_error = requirement_source.clone();
@@ -4936,6 +4938,7 @@ mcp_oauth_callback_port = 5678
             mcp_servers: None,
             rules: None,
             enforce_residency: None,
+            network: None,
         };
 
         let config = ConfigBuilder::default()