feat: load ExecPolicyManager from ConfigLayerStack (#8453)

https://github.com/openai/codex/pull/8354 added support for in-repo
`.config/` files, so this PR updates the logic for loading `*.rules`
files to load `*.rules` files from all relevant layers. The main change
to the business logic is `load_exec_policy()` in
`codex-rs/core/src/exec_policy.rs`.

Note this adds a `config_folder()` method to `ConfigLayerSource` that
returns `Option<AbsolutePathBuf>` so that it is straightforward to
iterate over the sources and get the associated config folder, if any.

codex-rs/utils/absolute-path/src/lib.rs

@@ -43,6 +43,13 @@ impl AbsolutePathBuf {
         Self::resolve_path_against_base(path, &self.0)
     }
 
+    pub fn parent(&self) -> Option<Self> {
+        self.0.parent().map(|p| {
+            #[expect(clippy::expect_used)]
+            Self::from_absolute_path(p).expect("parent of AbsolutePathBuf must be absolute")
+        })
+    }
+
     pub fn as_path(&self) -> &Path {
         &self.0
     }