Support configured credential providers in remote execution (#56049)

## Why

Remote credential masking previously fell back to unmasked execution whenever custom credential providers were configured.

## What changed

- Transport configured provider rules to the executor-local network proxy, where credential values and destination context are resolved.
- Advertise `credentialMaskingCustomProviders` and negotiate masking support. Keep the warning and unmasked fallback for executors that support only built-in providers.
- Discard provider rules when masking is disabled and omit their contents from debug output.

## Testing

Extend coverage for capability compatibility, provider configuration round trips, and fallback on older executors. Exercise configured-provider masking in remote request history and verify that masked placeholders are restored to real credentials in upstream request headers.

GitOrigin-RevId: b036f56900b343ddccc17b5293c82bc1f3426237

codex-rs/exec-server/src/process_sandbox.rs

@@ -72,9 +72,8 @@ struct PreparedWindowsSandboxRequest {
 impl PreparedExecRequest {
     #[cfg(unix)]
     pub(crate) fn credential_snapshot_proxy(&self, params: &ExecParams) -> Option<&NetworkProxy> {
-        if !params.network_proxy.as_ref()?.proxy.credential_masking
-            || !supports_credential_snapshot(params)
-        {
+        let launch = params.network_proxy.as_ref()?;
+        if !launch.proxy.credential_masking_enabled() || !supports_credential_snapshot(params) {
             return None;
         }
         self.network_proxy_handle.as_ref()?.proxy()

codex-rs/exec-server/src/process_sandbox_tests.rs

@@ -523,7 +523,9 @@ async fn native_request_handles_remote_proxy_config_for_platform(
     config.set_allowed_domains(vec!["allowed.example".to_string()]);
     let mut proxy_config = RemoteNetworkProxyConfig::from_effective_config(&config)
         .expect("supported remote proxy config");
-    proxy_config.credential_masking = credential_masking;
+    if credential_masking {
+        proxy_config.enable_credential_masking(Default::default());
+    }
     let params = ExecParams {
         metadata: Default::default(),
         process_id: ProcessId::from("process-remote-proxy"),
@@ -627,7 +629,7 @@ async fn disabled_remote_proxy_config_is_rejected_before_exporting_ports() {
     let mut proxy_config =
         RemoteNetworkProxyConfig::from_effective_config(&NetworkProxyConfig::default())
             .expect("serializable disabled proxy config");
-    proxy_config.credential_masking = true;
+    proxy_config.enable_credential_masking(Default::default());
     let params = ExecParams {
         metadata: Default::default(),
         process_id: ProcessId::from("process-disabled-remote-proxy"),