Consolidate async header authentication in apply_auth_headers (#57179)

## What changed

Remove `AuthProvider::resolve_auth_headers` and use `apply_auth_headers` as the async interface for header-only authentication. Migrate providers, callers, and existing tests to the shared interface, passing an empty `HeaderMap` when only authentication headers are needed.

Document that providers may refresh credentials asynchronously and that callers must use the returned header map so providers can remove superseded credentials.

GitOrigin-RevId: 42449de6fddd2be2c50c475c8e92628493197007

codex-rs/runtime-agent-instance/src/auth.rs

@@ -120,7 +120,7 @@ impl AuthProvider for RuntimeRequestAuth {
         Box::pin(async move {
             Ok(replace_auth_headers(
                 headers,
-                self.resolve_auth_headers().await?,
+                self.auth.auth_headers(self.mode)?,
             ))
         })
     }