Honor system proxy settings for remote plugins (#34509)

## Why

Remote plugin requests did not use Codex's effective outbound proxy policy, so
they could bypass configured system proxy and PAC routing.

## What changed

- Route remote plugin catalog, mutation, sharing, upload, and bundle download
  requests through the configured route-aware HTTP client.
- Select routes using the complete request URL, including encoded query
  parameters and backend-provided signed upload or download URLs.
- Preserve standard Codex headers and suppress diagnostics for URLs or headers
  that may contain credentials.

## Testing

Add coverage for route selection of catalog queries, workspace plugin uploads,
and backend-provided bundle download URLs.

GitOrigin-RevId: 106936659e21decf145b6ab4d4be84992e386861

codex-rs/login/src/auth/default_client.rs

@@ -225,6 +225,15 @@ pub fn create_client() -> HttpClient {
     HttpClient::new(inner)
 }
 
+/// Create the default HTTP client without request URL or response-header diagnostics.
+///
+/// This preserves the default client's legacy custom-CA fallback and reqwest proxy behavior while
+/// avoiding diagnostics that could expose credentials embedded in request URLs or headers.
+pub fn create_client_without_request_logging() -> HttpClient {
+    let inner = build_reqwest_client();
+    HttpClient::new_without_request_logging(inner)
+}
+
 /// Builds the default reqwest client used for ordinary Codex HTTP traffic.
 ///
 /// This starts from the standard Codex user agent, default headers, and sandbox-specific proxy