Add workload identity token exchange support (#37610)

## What changed

- Add the `codex-workload-identity` crate for exchanging a file-backed JWT assertion and federation rule ID for short-lived ChatGPT credentials.
- Cache valid access tokens, refresh them before expiry or after rejection, and coalesce concurrent exchanges. Continue using a still-valid cached token when a proactive refresh fails transiently.
- Validate assertion files, token endpoints, and exchange responses; honor outbound proxy policy for HTTPS endpoints and redact access tokens from debug output.

## Testing

- Cover request encoding, assertion rotation, caching, concurrent refreshes, transient-failure fallback, configuration validation, and malformed inputs and responses.

GitOrigin-RevId: 5496851683c2dcf6aaad6840053b97f7c0be076e

codex-rs/workload-identity/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-workload-identity"
+version.workspace = true
+
+[lib]
+doctest = false
+name = "codex_workload_identity"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+codex-http-client = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["fs", "io-util", "sync"] }
+url = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+tempfile = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+wiremock = { workspace = true }