[codex] Route Fed ChatGPT auth through Fed edge (#17151)

## Summary
- parse chatgpt_account_is_fedramp from signed ChatGPT auth metadata
- add _account_is_fedramp=true to ChatGPT backend-api requests only for
FedRAMP ChatGPT-auth accounts

codex-rs/login/src/token_data_tests.rs

@@ -114,6 +114,22 @@ fn id_token_info_handles_missing_fields() {
     let info = parse_chatgpt_jwt_claims(&fake_jwt).expect("should parse");
     assert!(info.email.is_none());
     assert!(info.get_chatgpt_plan_type().is_none());
+    assert_eq!(info.is_fedramp_account(), false);
+}
+
+#[test]
+fn id_token_info_parses_fedramp_account_claim() {
+    let fake_jwt = fake_jwt(serde_json::json!({
+        "email": "user@example.com",
+        "https://api.openai.com/auth": {
+            "chatgpt_account_id": "account-fed",
+            "chatgpt_account_is_fedramp": true,
+        }
+    }));
+
+    let info = parse_chatgpt_jwt_claims(&fake_jwt).expect("should parse");
+    assert_eq!(info.chatgpt_account_id.as_deref(), Some("account-fed"));
+    assert_eq!(info.is_fedramp_account(), true);
 }
 
 #[test]