Respect system proxies during plugin startup sync (#34506)

## Why

The curated plugin startup sync can fall back from Git to HTTP, but those
requests did not use Codex's effective outbound proxy policy.

## What changed

- Thread the configured HTTP client factory into curated plugin sync.
- Route GitHub API, zipball, backup metadata, and returned download URLs
  through the route-aware client when system proxy support is enabled.
- Preserve the existing default HTTP client behavior, including its custom CA
  fallback, when system proxy support is disabled.
- Apply the standard Codex headers to startup-sync HTTP requests.

## Testing

Add coverage that records route selection for repository, archive, metadata,
and backend-supplied download URLs, and verifies standard headers are sent.

GitOrigin-RevId: e1ea13bdab58a84c9948a2c8b82a5ec5c964ea99

codex-rs/core/src/config/mod.rs

@@ -1535,6 +1535,7 @@ impl Config {
             self.features.enabled(Feature::Plugins),
             self.features.enabled(Feature::RemotePlugin),
             self.chatgpt_base_url.clone(),
+            self.http_client_factory(),
         )
     }