Support managed OpenTelemetry metadata and PEM client identities (#57658)

## Why

Managed OpenTelemetry requirements could not specify span attributes or tracestate metadata.

## What changed

- Accept `otel.span_attributes` and `otel.tracestate` in requirements, merge them by attribute or member field, and expose them through app-server configuration and requirements reads.
- Protect required entries and their ancestors from configuration writes while preserving unmanaged sibling values and their origins. For example, requiring `otel.tracestate.vendor.tenant` leaves `vendor.region` writable. Empty metadata maps impose no requirements.
- Select Rustls when configuring an OTLP HTTP client certificate and private key so PEM client identities are accepted.

## Testing

Add coverage for metadata precedence, effective configuration, field-level write protection, and preservation of unmanaged values. Add blocking and asynchronous HTTP client construction tests using generated PEM certificates and keys.

GitOrigin-RevId: ada6000cc5e575b9a33451ec4aa58b6686dc20f7

sdk/python/src/openai_codex/generated/v2_all.py

@@ -9207,8 +9207,10 @@ class OtelRequirements(BaseModel):
     log_guardian_assessments: bool | None = None
     log_user_prompt: bool | None = None
     metrics_exporter: OtelExporter | None = None
+    span_attributes: dict[str, Any] | None = None
     tool_result: OtelToolResultLogConfig | None = None
     trace_exporter: OtelExporter | None = None
+    tracestate: dict[str, Any] | None = None
 
 
 class OverriddenMetadata(BaseModel):