Add model catalog fields for granular approval templates (#57325)

## What changed

Add optional `approvals.granular` catalog fields for the policy introduction and prompted and rejected category lists. Preserve template strings verbatim in `GranularApprovalMessages`, leaving validation and rendering to consumers.

Document the 500-byte template limit, required `{{ policy }}` and `{{ categories }}` markers, and fallback rules.

## Testing

Extend serialization tests to cover null, empty, and populated granular templates, and verify their preservation through model responses and base instruction overrides.

GitOrigin-RevId: ce32e41a9b37e2e7c45ac9b079708a640c99326c

codex-rs/core/src/context/world_state/permissions_tests.rs

@@ -263,6 +263,7 @@ fn permissions_state(
         on_request_auto_review: None,
         never: None,
         unless_trusted: None,
+        granular: None,
     };
     let permission_messages = PermissionMessages {
         danger_full_access: Some("Full access.".to_string()),