Expose managed application network requirements (#42417)

## What changed

- Add `application.network` managed requirements with exact-domain allow/deny
  rules, default-enabled behavior, domain normalization, and normal managed TOML
  precedence.
- Return the policy separately from agent network requirements through the
  experimental `configRequirements/read` API. The endpoint reports the policy
  but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.

## Testing

- Cover parsing, validation, normalization, layered precedence, and cloud
  requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
  rejection of invalid domains.

GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b

codex-rs/app-server-protocol/src/protocol/v2/mod.rs

@@ -1,6 +1,7 @@
 mod shared;
 
 mod account;
+mod application;
 mod apps;
 mod attestation;
 mod bedrock;
@@ -35,6 +36,7 @@ mod turn;
 mod windows_sandbox;
 
 pub use account::*;
+pub use application::*;
 pub use apps::*;
 pub use attestation::*;
 pub use bedrock::*;