Consolidate async header authentication in apply_auth_headers (#57179)

## What changed

Remove `AuthProvider::resolve_auth_headers` and use `apply_auth_headers` as the async interface for header-only authentication. Migrate providers, callers, and existing tests to the shared interface, passing an empty `HeaderMap` when only authentication headers are needed.

Document that providers may refresh credentials asynchronously and that callers must use the returned header map so providers can remove superseded credentials.

GitOrigin-RevId: 42449de6fddd2be2c50c475c8e92628493197007

codex-rs/exec-server/src/remote/auth_tests.rs

@@ -55,15 +55,16 @@ impl AuthProvider for RotatingAuth {
         Ok(())
     }
 
-    fn resolve_auth_headers(&self) -> codex_api::AuthHeadersFuture<'_> {
-        Box::pin(async {
+    fn apply_auth_headers(&self, mut headers: HeaderMap) -> codex_api::AuthHeadersFuture<'_> {
+        Box::pin(async move {
             self.stall_at(if self.refreshes.load(Ordering::SeqCst) == 0 {
                 AuthStage::Initial
             } else {
                 AuthStage::Retry
             })
             .await;
-            self.to_auth_headers()
+            self.add_auth_headers(&mut headers)?;
+            Ok(headers)
         })
     }
 

codex-rs/exec-server/src/remote/registration_retry_tests.rs

@@ -47,9 +47,9 @@ impl AuthProvider for RegistrationAuthProvider {
         Ok(())
     }
 
-    fn resolve_auth_headers(&self) -> codex_api::AuthHeadersFuture<'_> {
+    fn apply_auth_headers(&self, headers: HeaderMap) -> codex_api::AuthHeadersFuture<'_> {
         self.calls.fetch_add(1, Ordering::Relaxed);
-        Box::pin(async { Ok(HeaderMap::new()) })
+        Box::pin(async move { Ok(headers) })
     }
 }