Add rustls fallback for local MCP HTTP requests (#38436)

## Why

Local MCP requests can fail when the platform TLS backend cannot negotiate a
protocol version with an HTTPS endpoint.

## What changed

- Retry replayable local MCP requests once with rustls after a recognized TLS
  protocol-version negotiation failure. Keep certificate, timeout, and unrelated
  connection failures on the existing error path.
- Remember successful fallback per HTTPS origin and outbound route, while keeping
  the platform TLS backend as the default for other destinations.
- Share the fallback-enabled client across local MCP resolution, CLI login, and
  OAuth discovery while preserving remote environment HTTP clients.

## Testing

Added coverage for platform-specific error detection, request replay, cached
fallback reuse and isolation, non-replayable requests, redirects, and remote MCP
client selection.

GitOrigin-RevId: 39a2d96fdb2ea0e51df14f652ba2a953d24e69a1

codex-rs/exec-server/src/client/route_aware_http_client.rs

@@ -73,6 +73,13 @@ impl RouteAwareHttpClient {
         }
     }
 
+    /// Enables narrowly scoped TLS-backend fallback for both redirect policies.
+    pub fn with_tls_backend_fallback(mut self) -> Self {
+        self.follow_redirects = self.follow_redirects.with_tls_backend_fallback();
+        self.stop_redirects = self.stop_redirects.with_tls_backend_fallback();
+        self
+    }
+
     pub(crate) fn runner(
         &self,
         redirect_policy: HttpRedirectPolicy,