[codex] Route Fed ChatGPT auth through Fed edge (#17151)

## Summary
- parse chatgpt_account_is_fedramp from signed ChatGPT auth metadata
- add _account_is_fedramp=true to ChatGPT backend-api requests only for
FedRAMP ChatGPT-auth accounts

codex-rs/login/src/token_data.rs

@@ -36,6 +36,8 @@ pub struct IdTokenInfo {
     pub chatgpt_user_id: Option<String>,
     /// Organization/workspace identifier associated with the token, if present.
     pub chatgpt_account_id: Option<String>,
+    /// Whether the selected ChatGPT workspace must route through the FedRAMP edge.
+    pub chatgpt_account_is_fedramp: bool,
     pub raw_jwt: String,
 }
 
@@ -60,6 +62,10 @@ impl IdTokenInfo {
             Some(PlanType::Known(plan)) if plan.is_workspace_account()
         )
     }
+
+    pub fn is_fedramp_account(&self) -> bool {
+        self.chatgpt_account_is_fedramp
+    }
 }
 
 #[derive(Deserialize)]
@@ -88,6 +94,8 @@ struct AuthClaims {
     user_id: Option<String>,
     #[serde(default)]
     chatgpt_account_id: Option<String>,
+    #[serde(default)]
+    chatgpt_account_is_fedramp: bool,
 }
 
 #[derive(Deserialize)]
@@ -139,6 +147,7 @@ pub fn parse_chatgpt_jwt_claims(jwt: &str) -> Result<IdTokenInfo, IdTokenInfoErr
             chatgpt_plan_type: auth.chatgpt_plan_type,
             chatgpt_user_id: auth.chatgpt_user_id.or(auth.user_id),
             chatgpt_account_id: auth.chatgpt_account_id,
+            chatgpt_account_is_fedramp: auth.chatgpt_account_is_fedramp,
         }),
         None => Ok(IdTokenInfo {
             email,
@@ -146,6 +155,7 @@ pub fn parse_chatgpt_jwt_claims(jwt: &str) -> Result<IdTokenInfo, IdTokenInfoErr
             chatgpt_plan_type: None,
             chatgpt_user_id: None,
             chatgpt_account_id: None,
+            chatgpt_account_is_fedramp: false,
         }),
     }
 }