feat(core): add network constraints schema to requirements.toml (#10958)

## Summary

Add `requirements.toml` schema support for admin-defined network
constraints in the requirements layer

example config:

```
[experimental_network]
enabled = true
allowed_domains = ["api.openai.com"]
denied_domains = ["example.com"]
```

codex-rs/tui/src/debug_config.rs

@@ -338,6 +338,7 @@ mod tests {
             )])),
             rules: None,
             enforce_residency: Some(ResidencyRequirement::Us),
+            network: None,
         };
 
         let user_file = if cfg!(windows) {
@@ -393,6 +394,7 @@ mod tests {
             mcp_servers: None,
             rules: None,
             enforce_residency: None,
+            network: None,
         };
 
         let stack = ConfigLayerStack::new(Vec::new(), requirements, requirements_toml)