feat(app-server): add permission request capabilities

Add the `supportedServerRequests` initialize capability across the
app-server protocol, clients, and connection session state. This lets
surfaces explicitly advertise which conversational permission approval
requests they know how to receive.

Keep this branch limited to the opt-in contract and the bookkeeping
needed to store that capability per connection. Delivery and UI handling
stay in later stacked PRs so existing clients remain backward
compatible and the review surface stays small.

codex-rs/analytics/src/analytics_client_tests.rs

@@ -500,6 +500,7 @@ async fn initialize_caches_client_and_thread_lifecycle_publishes_once_initialize
                     },
                     capabilities: Some(InitializeCapabilities {
                         experimental_api: false,
+                        supported_server_requests: None,
                         opt_out_notification_methods: None,
                     }),
                 },
@@ -591,6 +592,7 @@ async fn compaction_event_ingests_custom_fact() {
                     },
                     capabilities: Some(InitializeCapabilities {
                         experimental_api: false,
+                        supported_server_requests: None,
                         opt_out_notification_methods: None,
                     }),
                 },