feat(approvals) RejectConfig for request_permissions (#14118)

## Summary
We need to support allowing request_permissions calls when using
`Reject` policy

<img width="1133" height="588" alt="Screenshot 2026-03-09 at 12 06
40 PM"
src="https://github.com/user-attachments/assets/a8df987f-c225-4866-b8ab-5590960daec5"
/>

Note that this is a backwards-incompatible change for Reject policy. I'm
not sure if we need to add a default based on our current use/setup

## Testing
- [x] Added tests
- [x] Tested locally

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -6752,6 +6752,10 @@
           "description": "Reject MCP elicitation prompts.",
           "type": "boolean"
         },
+        "request_permissions": {
+          "description": "Reject approval prompts related to built-in permission requests.",
+          "type": "boolean"
+        },
         "rules": {
           "description": "Reject prompts triggered by execpolicy `prompt` rules.",
           "type": "boolean"
@@ -6763,6 +6767,7 @@
       },
       "required": [
         "mcp_elicitations",
+        "request_permissions",
         "rules",
         "sandbox_approval"
       ],
@@ -9232,6 +9237,9 @@
                   "mcp_elicitations": {
                     "type": "boolean"
                   },
+                  "request_permissions": {
+                    "type": "boolean"
+                  },
                   "rules": {
                     "type": "boolean"
                   },
@@ -9241,6 +9249,7 @@
                 },
                 "required": [
                   "mcp_elicitations",
+                  "request_permissions",
                   "rules",
                   "sandbox_approval"
                 ],