Scope MCP resource reads by connector (#39244)

## What changed

- Add an optional `connectorId` to `mcpServer/resource/read`.
- Forward the selected connector through `x-codex-turn-metadata` for threaded and threadless resource reads, restricting hosted app resources to that connector.
- Update the generated protocol schemas and app-server documentation.

GitOrigin-RevId: 5cc94d703abbbb6086665910c1c9ed5dc7075210

codex-rs/app-server-protocol/src/protocol/v2/mcp.rs

@@ -90,6 +90,8 @@ pub struct McpResourceReadParams {
     pub origin_call_id: Option<String>,
     pub server: String,
     pub uri: String,
+    #[ts(optional = nullable)]
+    pub connector_id: Option<String>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]