Add enterprise IdP identity resolution for MCP OAuth (#40739)

## What changed

- Resolve stored enterprise IdP sessions against discovered authorization
  metadata, requiring the configured issuer, public-client authentication, and
  supported ID-JAG token exchange capabilities.
- Bind OIDC identity claims and MCP resource indicators to their configured
  issuer, client, and server, and require reauthentication when pinned keyring
  credentials are removed or replaced.
- Hold the credential lock while rereading refresh tokens, and isolate
  enterprise credentials by reserved namespace and Codex home.

## Testing

- Cover metadata and claim validation, resource binding, credential replacement
  and keyring failures, refresh locking, expired ID tokens, and credential
  namespace isolation.

GitOrigin-RevId: edce3c6159f7d6831edf72e9608b3fc3f5823c83

codex-rs/config/src/mcp_types.rs

@@ -260,10 +260,13 @@ impl McpServerConfig {
         self.environment_id == DEFAULT_MCP_SERVER_ENVIRONMENT_ID
     }
 
-    /// Keeps local OAuth credentials compatible while isolating executor-owned servers.
+    /// Keeps local OAuth credentials compatible while reserving managed credential namespaces.
     pub fn oauth_credential_name<'a>(&self, server_name: &'a str) -> Cow<'a, str> {
         if self.is_local_environment() {
-            if server_name.starts_with("executor:") || server_name.starts_with("local:") {
+            if server_name.starts_with("executor:")
+                || server_name.starts_with("local:")
+                || server_name.starts_with("ema-idp:")
+            {
                 Cow::Owned(format!("local:{server_name}"))
             } else {
                 Cow::Borrowed(server_name)