Preserve local-binding inheritance in environment network policies (#47898)

## Why

Treating an omitted `allow_local_binding` setting as `false` prevents environment policies from inheriting local-binding permissions.

## What changed

Keep `allow_local_binding` optional when composing controller and environment policies. Preserve explicit denials from either policy and resolve executor defaults after composition. Without a controller, default to denying local binding unless the environment explicitly allows it.

## Testing

Add coverage for omitted, allowed, and denied settings, managed constraints, executor defaults, and remote launch rejection when local-binding restrictions cannot be enforced. Extend remote network approval tests with loopback requests to verify controller and environment policy composition.

GitOrigin-RevId: aa0d15e8be87a2741255cd3a5a2cabffa03214ac

codex-rs/network-proxy/src/proxy.rs

@@ -979,10 +979,10 @@ impl NetworkProxy {
                 config.mitm = false;
             }
         }
-        config.allow_local_binding = Some(local_binding_policy.resolve(&config));
         if let Some(policy) = environment_policy {
             policy.apply_to(&mut config);
         }
+        config.allow_local_binding = Some(local_binding_policy.resolve(&config));
         anyhow::ensure!(
             environment_policy.is_none() || config.enabled,
             "environment network policy requires an enabled executor proxy"