Honor system proxy settings for remote plugins (#34509)

## Why

Remote plugin requests did not use Codex's effective outbound proxy policy, so
they could bypass configured system proxy and PAC routing.

## What changed

- Route remote plugin catalog, mutation, sharing, upload, and bundle download
  requests through the configured route-aware HTTP client.
- Select routes using the complete request URL, including encoded query
  parameters and backend-provided signed upload or download URLs.
- Preserve standard Codex headers and suppress diagnostics for URLs or headers
  that may contain credentials.

## Testing

Add coverage for route selection of catalog queries, workspace plugin uploads,
and backend-provided bundle download URLs.

GitOrigin-RevId: 106936659e21decf145b6ab4d4be84992e386861

codex-rs/deny.toml

@@ -243,7 +243,6 @@ deny = [
         "codex-api",
         "codex-app-server",
         "codex-core",
-        "codex-core-plugins",
         "codex-exec-server",
         "codex-lmstudio",
         "codex-login",