Preserve MCP compatibility with older executors (#39979)

## Why

Older executors do not support resolving HTTP header values from their own
environment. Sending environment-backed bearer tokens to them can prevent MCP
servers from starting.

## What changed

- Advertise executor support for environment-backed HTTP headers with the
  `httpHeaderEnvVars` capability.
- Delegate bearer-token resolution only when the selected executor advertises
  that capability; otherwise, resolve tokens available in the host environment.
- Exclude executor-owned MCP servers that require environment-backed bearer
  tokens when the executor cannot resolve them, while retaining compatible
  host-owned and executor-owned servers.

## Testing

Added protocol and environment-variable coverage plus an end-to-end test that
simulates an older executor and verifies compatible MCP servers remain usable.

GitOrigin-RevId: 43545926f6f7e0f3b1091eb29d34647f6372bc4a

codex-rs/codex-mcp/src/server_tests.rs

@@ -18,6 +18,17 @@ fn remote_http_connections_track_host_headers_but_not_executor_bearer_tokens() {
         vec![("PATH".to_string(), std::env::var_os("PATH"))],
     );
 
+    let remote_host_bearer: McpServerConfig = serde_json::from_value(serde_json::json!({
+        "url": "https://example.com/mcp",
+        "environment_id": "executor-1",
+        "bearer_token_env_var": "PATH",
+    }))
+    .expect("host-resolved remote MCP configuration should deserialize");
+    assert_eq!(
+        referenced_environment_variables(&remote_host_bearer),
+        vec![("PATH".to_string(), std::env::var_os("PATH"))],
+    );
+
     config.environment_id = DEFAULT_MCP_SERVER_ENVIRONMENT_ID.to_string();
     assert_eq!(
         referenced_environment_variables(&config),