Enable GitHub Actions OIDC authentication in the Responses API proxy (#55320)

## Why

GitHub Actions workflows can use short-lived OpenAI credentials instead of storing a long-lived OpenAI API key in GitHub secrets.

## What changed

- Add `--github-oidc` with required audience, identity provider, service account, and GitHub token-request URL settings. Read the GitHub request credential from stdin and connect it to the existing federated authentication flow.
- Require the default OpenAI Responses endpoint in OIDC mode before reading credentials, and complete the initial token exchange before publishing server info.
- Close the npm launcher's copy of stdin after the native child starts.
- Document OIDC setup, credential handling, renewal behavior, and caller responsibilities. Keep API-key authentication as the default.

## Testing

Add tests for required OIDC flags, upstream restrictions before credential reads, rejection of unsafe or empty settings without exposing sensitive input, and failure when a configured custom CA cannot be loaded in the CLI blocking context.

GitOrigin-RevId: 7de6fd4c3491e7ccd6a2c2ccdee0bc2eedd0e642

codex-rs/responses-api-proxy/src/github_oidc.rs

@@ -29,7 +29,6 @@ pub(crate) struct GithubOidc {
 }
 
 impl GithubOidc {
-    #[expect(dead_code, reason = "CLI is wired in a later stack layer")]
     pub(crate) fn from_stdin(request_url: &str, audience: &str) -> Result<Self> {
         // Avoid echoing caller-supplied URL parameters in parsing errors.
         let mut request_url =