Add device-code authorization for gateway OAuth (#59822)

## Why

Gateway sign-in needs an alternative for terminals that cannot open a browser.

## What changed

- Add optional `gateway_oauth.device_authorization_url` configuration and a `login_with_device_code` API that presents a verification URL and user code, polls for approval, and persists the resulting credentials.
- Use the configured proxy and network policy, validate verification URLs, and bound OAuth responses. Support cancellation and report denied or expired codes without exposing issuer error details.

## Testing

Add tests for successful authorization and credential persistence, unsafe verification URLs, network-policy denials, denied and expired codes, and cancellation during approval or credential storage.

GitOrigin-RevId: 96398578fb866d34929e85c04eadf468d8cd3255

codex-rs/http-client/src/lib.rs

@@ -84,6 +84,7 @@ pub use crate::transport::ByteStream;
 pub use crate::transport::HttpTransport;
 pub use crate::transport::ReqwestTransport;
 pub use crate::transport::StreamResponse;
+pub use crate::transport::bounded_response_bytes;
 
 #[cfg(windows)]
 mod windows_proxy_auth;

codex-rs/http-client/src/transport.rs

@@ -297,7 +297,7 @@ fn bounded_response_stream(
     Ok(Box::pin(stream))
 }
 
-async fn bounded_response_bytes(
+pub async fn bounded_response_bytes(
     response: HttpResponse,
     max_bytes: usize,
 ) -> Result<Bytes, TransportError> {