Scope MCP resource reads by connector (#39244)

## What changed

- Add an optional `connectorId` to `mcpServer/resource/read`.
- Forward the selected connector through `x-codex-turn-metadata` for threaded and threadless resource reads, restricting hosted app resources to that connector.
- Update the generated protocol schemas and app-server documentation.

GitOrigin-RevId: 5cc94d703abbbb6086665910c1c9ed5dc7075210

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -13295,6 +13295,12 @@
       "McpResourceReadParams": {
         "$schema": "http://json-schema.org/draft-07/schema#",
         "properties": {
+          "connectorId": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
           "originCallId": {
             "description": "Originating MCP tool call used to select the resource's app.",
             "type": [