Support gRPC code-mode hosts in app server (#38288)

## What changed

- Accept root `http://` and `https://` URLs in `--code-mode-host` and use the
  shared gRPC session provider for those endpoints.
- Keep `ws://` and `wss://` URLs on the existing WebSocket transport.
- Reject paths, queries, fragments, and credentials where unsupported, without
  exposing gRPC URL credentials in command-line validation errors.

## Testing

- Cover argument parsing and transport selection for both remote protocols.
- Exercise a gRPC host shared across app-server threads and verify credential
  rejection does not disclose usernames or passwords.

GitOrigin-RevId: b6516a85cf76db5c4cea620f89ef866d8af30cf0

codex-rs/code-mode/src/grpc_session/transport.rs

@@ -72,6 +72,11 @@ impl SharedTransport {
                         if !matches!(target.scheme(), "http" | "https") {
                             return Err("gRPC code-mode host URL must use http or https".to_string());
                         }
+                        if !target.username().is_empty() || target.password().is_some() {
+                            return Err(
+                                "gRPC code-mode host URL must not include credentials".to_string(),
+                            );
+                        }
                         if target.path() != "/"
                             || target.query().is_some()
                             || target.fragment().is_some()