Honor system proxy settings for remote plugins (#34509)

## Why

Remote plugin requests did not use Codex's effective outbound proxy policy, so
they could bypass configured system proxy and PAC routing.

## What changed

- Route remote plugin catalog, mutation, sharing, upload, and bundle download
  requests through the configured route-aware HTTP client.
- Select routes using the complete request URL, including encoded query
  parameters and backend-provided signed upload or download URLs.
- Preserve standard Codex headers and suppress diagnostics for URLs or headers
  that may contain credentials.

## Testing

Add coverage for route selection of catalog queries, workspace plugin uploads,
and backend-provided bundle download URLs.

GitOrigin-RevId: 106936659e21decf145b6ab4d4be84992e386861

codex-rs/http-client/src/default_client.rs

@@ -31,9 +31,9 @@ impl HttpClient {
 
     /// Creates a client that suppresses request URL and response-header diagnostics.
     ///
-    /// Use this for authentication endpoints whose URLs or headers may contain credentials that
-    /// are redacted by the caller above the HTTP transport boundary.
-    pub(crate) fn new_without_request_logging(inner: reqwest::Client) -> Self {
+    /// Use this for endpoints whose URLs or headers may contain credentials that are redacted by
+    /// the caller above the HTTP transport boundary.
+    pub fn new_without_request_logging(inner: reqwest::Client) -> Self {
         Self {
             inner,
             request_logging: RequestLogging::Disabled,