Extend configured credential brokerage to embedded aliases (#44066)

## What changed

- Discover configured provider credentials in child environment values even when canonical credential variables are absent. Match complete tokens while preserving regex word boundaries and avoiding ambiguous or overlapping provider matches.
- Replace and restore credentials by their original spans, preserving adjacent tokens and generated dummy aliases across destination rebinding. Reject dummy values that embed another provider's credentials.
- Extend text virtualization and provider source checks to configured credentials, including short credentials with distinctive prefixes, while preserving operational paths.
- Expose trusted provider metadata and active bindings through `CredentialBrokerEnvironment`, and remove marked configured credential variables when stripping the managed proxy environment.

## Testing

Add regression tests for alias discovery, regex boundaries and alternatives, overlapping and adjacent credentials, destination rebinding, dummy restoration, disallowed credential sources, and operational path preservation.

GitOrigin-RevId: dd85c595ce9550fbfdb07ef296a23e458ca165dd

codex-rs/network-proxy/src/runtime.rs

@@ -515,6 +515,24 @@ impl NetworkProxyState {
         self.credential_broker.virtualize_text(text, env)
     }
 
+    pub(crate) fn credential_broker_environment(
+        &self,
+        env: &HashMap<String, String>,
+    ) -> crate::CredentialBrokerEnvironment {
+        self.credential_broker.environment(env)
+    }
+
+    pub(crate) fn credential_broker_sources_allowed(
+        &self,
+        value: &str,
+        virtualized: &str,
+        source_env: &HashMap<String, String>,
+        is_allowed: impl Fn(&str) -> bool,
+    ) -> bool {
+        self.credential_broker
+            .provider_sources_allowed(value, virtualized, source_env, is_allowed)
+    }
+
     pub(crate) fn restore_brokered_text(&self, text: &mut String) -> bool {
         self.credential_broker.restore_text(text)
     }