feat(approvals) RejectConfig for request_permissions (#14118)

## Summary
We need to support allowing request_permissions calls when using
`Reject` policy

<img width="1133" height="588" alt="Screenshot 2026-03-09 at 12 06
40 PM"
src="https://github.com/user-attachments/assets/a8df987f-c225-4866-b8ab-5590960daec5"
/>

Note that this is a backwards-incompatible change for Reject policy. I'm
not sure if we need to add a default based on our current use/setup

## Testing
- [x] Added tests
- [x] Tested locally

codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json

@@ -24,6 +24,9 @@
                 "mcp_elicitations": {
                   "type": "boolean"
                 },
+                "request_permissions": {
+                  "type": "boolean"
+                },
                 "rules": {
                   "type": "boolean"
                 },
@@ -33,6 +36,7 @@
               },
               "required": [
                 "mcp_elicitations",
+                "request_permissions",
                 "rules",
                 "sandbox_approval"
               ],