Support gRPC code-mode hosts in app server (#38288)

## What changed

- Accept root `http://` and `https://` URLs in `--code-mode-host` and use the
  shared gRPC session provider for those endpoints.
- Keep `ws://` and `wss://` URLs on the existing WebSocket transport.
- Reject paths, queries, fragments, and credentials where unsupported, without
  exposing gRPC URL credentials in command-line validation errors.

## Testing

- Cover argument parsing and transport selection for both remote protocols.
- Exercise a gRPC host shared across app-server threads and verify credential
  rejection does not disclose usernames or passwords.

GitOrigin-RevId: b6516a85cf76db5c4cea620f89ef866d8af30cf0

codex-rs/code-mode-host/tests/grpc.rs

@@ -175,6 +175,27 @@ async fn start_active_wait(
     Ok(wait)
 }
 
+#[tokio::test]
+async fn grpc_endpoints_reject_credentials_without_disclosing_them() {
+    for endpoint in [
+        "http://alice:secret@host.example",
+        "https://alice:secret@host.example",
+        "https://alice@host.example",
+        "https://:secret@host.example",
+    ] {
+        let provider = GrpcCodeModeSessionProvider::new(endpoint);
+        let error = provider
+            .create_session(Arc::new(NoopCodeModeSessionDelegate))
+            .await
+            .err()
+            .expect("gRPC credentials should be rejected");
+
+        assert!(error.contains("must not include credentials"));
+        assert!(!error.contains("alice"));
+        assert!(!error.contains("secret"));
+    }
+}
+
 #[tokio::test]
 async fn tcp_session_persists_values_and_forwards_tools_notifications_and_closure() -> Result<()> {
     let host = HostHarness::start("grpc://127.0.0.1:0").await?;