Route gRPC code-mode sessions through the shared HTTP client (#38087)

## What changed

- Build URL-based gRPC code-mode connections with `HttpClientFactory` so they support the application's outbound proxy and custom CA configuration.
- Accept `http` and `https` origins while rejecting endpoints with unsupported schemes, paths, queries, or fragments.
- Preserve custom tonic channel injection and gRPC frame-size limits through the new transport adapter.

GitOrigin-RevId: 142f0b572b3ab0154e8fe860cb304752a9af5784

codex-rs/deny.toml

@@ -238,6 +238,8 @@ deny = [
     { crate = "reqwest", wrappers = [
         # Intended owner.
         "codex-http-client",
+        # Intentional exception: gRPC uses reqwest directly as tonic's HTTP/2 transport.
+        "codex-code-mode",
         # Intentional exception: this standalone, privileged Responses API proxy owns its blocking
         # upstream HTTP transport independently of Codex.
         "codex-responses-api-proxy",