Ignore ripgrep configuration when expanding sandbox deny globs (#51527)

## Why

User ripgrep configuration can suppress the file list used to construct Linux sandbox deny masks. For example, `--quiet` in `RIPGREP_CONFIG_PATH` can leave files matching deny globs unmasked.

## What changed

Pass `--no-config` to the ripgrep invocation that expands denied-file globs.

## Testing

Extend the multiple-denied-files regression test with a ripgrep configuration containing `--quiet`, checking that denied files remain unreadable and unwritable while allowed files remain accessible. Skip the ripgrep-specific case when no protected `rg` executable is available.

GitOrigin-RevId: 06a6e27e0edec92e79e99af5144b57f86079953f

codex-rs/linux-sandbox/src/bwrap.rs

@@ -1019,6 +1019,7 @@ fn ripgrep_files(
     // case, not a sandbox construction error.
     let mut command = Command::new(rg_path);
     command
+        .arg("--no-config")
         .arg("--files")
         .arg("--hidden")
         .arg("--no-ignore")

codex-rs/linux-sandbox/tests/suite/denied_files_tests.rs

@@ -73,6 +73,13 @@ async fn sandbox_starts_with_multiple_denied_files(rules: DeniedFileRules) {
         FileSystemSandboxEntry::new(workspace.clone().into(), FileSystemAccessMode::Write),
     ];
     let mut env = create_env_from_core_vars();
+    // User config must not suppress the files used to construct deny masks.
+    let rg_config = workspace.join("ripgrep.conf");
+    std::fs::write(rg_config.as_path(), "--quiet\n").expect("write ripgrep config");
+    env.insert(
+        "RIPGREP_CONFIG_PATH".to_string(),
+        rg_config.to_str().expect("UTF-8 config path").to_string(),
+    );
     let rg_fixture = if use_controlled_rg_path {
         let fixture = tempfile::tempdir_in(temp.path().parent().expect("workspace parent"))
             .expect("rg fixture");
@@ -151,6 +158,17 @@ printf '%s\000' "$CODEX_TEST_DENIED_PATH_0" "$CODEX_TEST_DENIED_PATH_1" "$CODEX_
         &FileSystemSandboxPolicy::restricted(entries),
         NetworkSandboxPolicy::Enabled,
     );
+    if matches!(rules, DeniedFileRules::Globs)
+        && codex_sandboxing::find_pre_sandbox_executable_in_path(
+            "rg",
+            &permission_profile.file_system_sandbox_policy(),
+            workspace.as_path(),
+        )
+        .is_none()
+    {
+        eprintln!("skipping ripgrep config test: no protected rg is available");
+        return;
+    }
     let output = run_cmd_result_with_permission_profile_for_cwd(
         &[
             "/bin/sh",