Share runtime authentication with model providers and catalogs (#57607)

## Why

Model catalog refreshes need to use the same registered actor and credential owner as model requests when runtime authentication is enabled.

## What changed

- Add `ProviderAuthContext` to carry credentials and optional runtime authentication into model providers and catalog clients.
- Select runtime authentication independently for inference and catalog destinations. Reject unsupported OpenAI origins while preserving provider authentication for other destinations.
- Include API organization and project selectors in runtime registration. Reuse registered runtimes across projects within an organization and replace them when the organization changes.
- Preserve transport restrictions and account bindings, and strip sensitive headers on cross-origin redirects.
- Apply the catalog timeout to authentication and fetching while allowing credential refresh and registration to finish safely.

## Testing

Add coverage for runtime-authenticated catalogs, provider isolation, resource selection, gateway authentication, cross-origin redirects, and timeout recovery that preserves registration and refreshed tokens.

GitOrigin-RevId: c14f1a02159031ea0af1f9b26ea890f8dca7d6ad

codex-rs/http-client/src/route_aware_client_pool/execution.rs

@@ -211,7 +211,12 @@ impl RouteAwareClientPool {
             if redirects >= MAX_REDIRECTS {
                 return Err(RouteAwareRequestError::TooManyRedirects);
             }
-            remove_sensitive_headers(next_request.headers_mut(), &current_url, &next_request_url);
+            remove_sensitive_headers(
+                next_request.headers_mut(),
+                &current_url,
+                &next_request_url,
+                self.http_client_factory.protects_sensitive_headers(),
+            );
             insert_referer(next_request.headers_mut(), &current_url, &next_request_url);
             request = next_request;
             redirects += 1;